Database
WordPress Vulnerability Database (page 1416)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Path Traversal
WP Marketplace – Complete Shopping Cart / eCommerce Solution
<2.4.1Update to 2.4.1
- High7.5Missing Authorization to Database Export
All-in-One WP Migration and Backup
≤2.0.4Update to 2.0.5
- High7.2Stored Cross-Site Scripting
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤5.3.2Update to 5.3.3
- Medium6.4Authenticated Stored Cross-Site Scripting
Easy Coming Soon
≤1.6.1Update to 1.6.3
- High8.8Cross-Site Request Forgery
Ajax Search Pro
≤3.5Update to 4.0
- Critical9.1SQL Injection
Gravity Forms
≤1.9.3.5Update to 1.9.3.6
- Critical9.8SQL Injection
Knews Multilingual Newsletters
≤1.7.0Update to 1.7.1
- Critical9.8SQL Injection
Pods – Custom Content Types and Fields
<2.5.1.2Update to 2.5.1.2
- Critical9.8Arbitrary File Upload
ReFlex Gallery » WordPress Photo Gallery
<3.1.4Update to 3.1.4
- Critical9.8Arbitrary File Upload
Work The Flow File Upload
≤2.5.2Update to 2.5.3
- Medium5.4Authenticated Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.13Update to 1.2.13
- Medium4.9Directory Traversal
IP Blacklist Cloud
<3.43Update to 3.43
- High7.2Stored Cross-Site Scripting
WooCommerce
<2.3.6Update to 2.3.6
- High7.2Authenticated (Admin+) SQL Injection
Responsive Slider – Image Slider – Slideshow for WordPress
<2.7.0Update to 2.7.0
- Medium6.1Responsive Photo Gallery <= 1.7.0 - Reflected Cross-Site Scripting via thumbtext
Image Gallery - Responsive Photo Gallery
<1.7.1Update to 1.7.1
- Medium6.3Missing Authorization
Custom Field Suite
≤2.4Update to 2.4.1
- Critical9.8SQL Injection
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.2.5Update to 3.2.5
- Medium6.1Cross-Site Scripting
wpml
<3.1.9Update to 3.1.9
- High8.8Cross-Site Request Forgery
SpiderCalendar
≤1.4.13Update to 1.4.14
- High8.8Blind SQL Injection
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤1.7.3Update to 1.5.7 or 1.6.4 or 1.7.4
- Critical9.8SQL Injection
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.2.0Update to 3.2.0
- Medium6.1Cross-Site Scripting
Daily Edition
≤1.6.2No patch available
- Critical9.8Authorization Bypass to Arbitrary File Upload/Delete
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.0.84Update to 1.0.84
- Critical9.8SQL Injection via lang Parameter
WPML Multilingual CMS
≤3.1.9Update to 3.1.9.1
- Critical9.8Arbitrary Options Update
Faction
≤1.1.1No patch available
- High7.5Arbitrary Deletion of Content
WPML Multilingual CMS
≤3.1.9Update to 3.1.9.1
- High7.5Cross-Site Request Forgery
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤1.7.3.3Update to 1.5.7 or 1.6.4 or 1.7.4
- High8.32.0.24 - Stored Cross-Site Scripting
Custom Community
2.0 – <2.0.25Update to 2.0.25
- Critical9.8Authentication Bypass
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
<2.0.9.2Update to 2.0.9.2
- Critical9.8Arbitrary File Upload
WPshop 2 – E-Commerce
<1.3.9.6Update to 1.3.9.6