Database
WordPress Vulnerability Database (page 1414)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Manual Purchases Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting
Easy Digital Downloads - Cross-Sell and Upsell
≤1.1.2Update to 1.1.3
- Medium6.1Reflected Cross-Site Scripting
WP eCommerce
≤3.9.2Update to 3.9.3
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Simple Shipping
≤2.1.3Update to 2.1.4
- Medium6.1Reflected Cross-Site Scripting
TinyChat Room Spy
≤1.2.8Update to 1.2.9
- High7.2SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
≤1.4.95Update to 1.4.96
- Medium6.1Cross-Site Scripting
WordPress Content Slide
≤1.4.2No patch available
- Critical9.8SQL Injection
AJAX Store Locator
≤1.2No patch available
- High7.1Reflected Cross-Site Scripting
Citizen Space
≤1.1No patch available
- High7.5Arbitrary File Download
wp-mon
≤0.5.1No patch available
- High8.8Cross-Site Request Forgery leading to Remote Code Execution
miwoftp
<1.0.6Update to 1.0.6
- Medium5.3Cross-Site Scripting
Contact Form by ContactMe.com
≤2.3No patch available
- High8.8Cross-Site Request Forgery to Arbitrary File Deletion
miwoftp
<1.0.6Update to 1.0.6
- High7.5Missing Access Controls
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.1.3Update to 2.1.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
<9.1.3Update to 9.1.3
- Medium6.5Directory Traversal
Crayon Syntax Highlighter
<2.7.0Update to 2.7.0
- Medium6.5Stored Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
<4.6.13Update to 4.6.13
- Medium5.3SQL Injection
WP Symposium
<15.4Update to 15.4
- High8.6Arbitrary File Download
miwoftp
<1.0.5Update to 1.0.5
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
≤2.8Update to 2.8.1
- Medium6.1Cross-Site Scripting
My Wish List
<1.4.2Update to 1.4.2
- Critical9.8Arbitrary File Upload
Website Contact Form With File Upload
≤1.3.4Update to 1.4
- Critical9.8SQL Injection
cformsII
<14.6.10Update to 14.6.10
- High8.8SQL Injection
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤0.5.14Update to 0.5.16
- Medium5.3Local File Inclusion
Fusion Engage
≤1.0.5No patch available
- Critical9.8Arbitrary File Upload/Deletion
Easy Digital Downloads – Upload File
≤1.0.3Update to 1.0.4
- High7.5Sensitive Information Disclosure
WP REST API (WP API)
<1.2.1Update to 1.2.1
- Critical9.8Arbitrary File Upload
Windows Desktop and iPhone Photo Uploader
≤1.8No patch available
- High8.8Remote Code Execution
Gantry 4 Framework
≤4.1.3Update to 4.1.4
- Medium6.4Cross-Site Scripting via example.html
WordPress
≤4.2.1Update to 3.7.8 or 3.8.8 or 3.9.6 or 4.0.5 or 4.1.5 or 4.2.2