Database
WordPress Vulnerability Database (page 1410)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Cross-Site Scripting
Affiliate Ads for cbAds.com
≤1.20Update to 1.35
- Medium6.1Cross-Site Scripting
Artificial Intelligence
<1.2.4Update to 1.2.4
- Medium6.1DOM Cross-Site Scripting
PrettyPhoto – Simple Lightbox Plugin
≤1.1Update to 1.2
- Medium4.3Cross-Site Request Forgery
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤3.7.2Update to 3.7.3
- Medium6.1Cross-Site Scripting
Shortcodes Ultimate – Content Elements
≤4.9.3Update to 4.9.4
- Critical9.8SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
2.0.14 – 2.0.15Update to 2.0.16
- Critical9.82.0.15 - Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction
2.0.14 – 2.0.15Update to 2.0.16
- Medium6.1Cross-Site Scripting
WeeklyNews
<2.2.9Update to 2.2.9
- High7.52.2.21 - Information Exposure
Slideshow
2.2.8 – 2.2.21Update to 2.2.22
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
<1.5.3Update to 1.5.3
- Medium6.1Reflected Cross-Site Scripting
GF Windcave Free
≤1.4.2Update to 1.4.3
- Critical9.8Local File Disclosure and Arbitrary File Upload
Premium Seo Pack – Light Version
≤1.8.0No patch available
- Medium4.9Directory Traversal
TheCartPress eCommerce Shopping Cart
≤1.5.3.6No patch available
- High7.5Sensitive Information Disclosure
TheCartPress eCommerce Shopping Cart
≤1.5.3.6No patch available
- Medium6.1Multiple Cross-Site Scripting
TheCartPress eCommerce Shopping Cart
≤1.5.3.6No patch available
- Medium4.7Cross-Site Request Forgery leading to Stored Cross-Site Scripting
White Label CMS
<1.5.3Update to 1.5.3
- High7.5HTTP Response Splitting
Smart External Link Click Monitor [Link Log]
≤1.4Update to 2.0
- Critical9.8SQL Injection
rtMedia for WordPress, BuddyPress and bbPress
<3.7.40Update to 3.7.40
- Medium6.1Ultimate Newspaper Theme <= 1.3.3 - Cross-Site Scripting
Exquisite - Ultimate Newspaper Theme
≤1.3.3No patch available
- High7.5Arbitrary File Read
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤3.7Update to 3.7.1
- Medium6.1Reflected Cross-Site Scripting
Resend Welcome Email
≤1.0.1Update to 1.0.2
- High7.2Cross-Site Scripting via Comments
WordPress
≤4.2Update to 4.0.4 or 4.1.4 or 4.2.1
- High8.8Cross-Site Request Forgery
WPS Hide Login
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
FeedWordPress
≤2014.0805Update to 2015.0426
- Critical9.8Unauthenticated Arbitrary File Upload
WooCommerce Amazon Affiliates
<9.0.2.16Update to 9.0.2.16
- Medium6.1Reflected Cross-Site Scripting
The7 — Website and eCommerce Builder for WordPress
≤2.1.0Update to 2.1.1
- Medium5.3Information Disclosure
MashShare – Social Media Share Buttons, Social Share Icons
<2.3.1Update to 2.3.1
- High8.8Privilege Escalation
QAEngine
≤1.4Update to 1.5
- Medium6.1Reflected Cross-Site Scripting
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.7Update to 2.3.7
- Medium6.1Reflected Cross-Site Scripting
Mark User as Spammer
≤1.0.1Update to 1.0.2