Database
WordPress Vulnerability Database (page 1409)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Sensitive Information Disclosure
WP Backup+
all versionsNo patch available
- Medium6.1Reflected Cross-Site Scripting
Visual Form Builder
<2.8.3Update to 2.8.3
- Medium6.5Arbitrary Shortcode Execution
Awesome Support – WordPress HelpDesk & Support Plugin
<3.1.7Update to 3.1.7
- Medium6.1Reflected Cross-Site Scripting
FeedWordPress
<2015.0514Update to 2015.0514
- Medium6.1Cross-Site Scripting
Videopack
<4.1Update to 4.1
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Contact Form Email
<1.3.12Update to 1.3.12
- Medium6.1Cross-Site Scripting
Post Kinds
<1.3.1.1Update to 1.3.1.1
- Medium6.1DOM-based Cross-Site Scripting
Syndication Links
<1.3Update to 1.3
- Medium6.1Cross-Site Scripting
Modern
≤1.4.1Update to 1.4.2
- Medium4.3Cross-Site Request Forgery
Inline Google Spreadsheet Viewer
≤0.9.6Update to 0.9.6.1
- Critical9.6Cross-Site Request Forgery to Cross-Site Scripting
WP Fast Cache
≤1.4Update to 1.5
- Medium6.1Reflected Cross-Site Scripting
Google AdSense Click-Fraud Monitoring Plugin
≤1.8.6No patch available
- Critical9.8Remote Code Execution
Backup, Restore and Migrate your sites with XCloner
<3.1.3Update to 3.1.3
- Medium6.1Cross-Site Scripting
Backup, Restore and Migrate your sites with XCloner
≤3.1.2Update to 3.1.3
- High8.8Remote Command Execution
Backup, Restore and Migrate your sites with XCloner
≤3.1.2Update to 3.1.3
- High7.2Cross-Site Scripting
Roomcloud
<1.3Update to 1.3
- High8.2Arbitrary File Upload
Iptanus File Upload
<2.7.1Update to 2.7.1
- Critical9.8Cross-Site Request Forgery
YARPP – Yet Another Related Posts Plugin
<4.2.5Update to 4.2.5
- Critical9.8SQL Injection
Amazon Product in a Post Plugin
<3.5.3Update to 3.5.3
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Ad Buttons
<2.3.2Update to 2.3.2
- High7.2Cross-Site Scripting via Comments
WordPress
≤4.2.1Update to 3.7.8 or 3.8.8 or 3.9.6 or 4.0.5 or 4.1.5 or 4.2.2
- High7.1Cross-Site Request Forgery to Cross-Site Scripting
Ultimate Profile Builder
<3.0Update to 3.0
- Medium6.1Reflected Cross-Site Scripting
embed-articles
≤7.0.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Simplr Registration Form Plus+
≤2.3.4Update to 2.3.5
- High8.8SQL Injection
Freshmail for WordPress
<1.6Update to 1.6
- Critical9.8Multiple SQL Injections
Freshmail for WordPress
≤1.5.8Update to 1.6
- High7.2Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤3.5.2Update to 3.5.3
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Affiliate Ads for cbAds.com
<1.31Update to 1.31
- Medium6.1Cross-Site Scripting
Artificial Intelligence
<1.2.4Update to 1.2.4
- Medium4.8Cross-Site Scripting
Affiliate Ads for cbAds.com
≤1.20Update to 1.35