Database
WordPress Vulnerability Database (page 1417)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Authentication Bypass
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
<2.0.9.2Update to 2.0.9.2
- Medium5.3Directory Listing to Information Disclosure
Download Monitor
≤1.6.3Update to 1.6.4
- Critical9.8Arbitrary File Upload
Daily Edition
≤1.6.2Update to 1.6.3
- Medium4.3Missing Authorization Checks
Tweet Wheel
≤0.2Update to 0.3
- High7.4Authenticated Stored Cross-Site Scripting
Contact Form by FormGet – Best Form Builder Plugin for WordPress
<5.3.1Update to 5.3.1
- Medium4.9Authenticated (Admin+) Path Traversal
IP Blacklist Cloud
≤3.42Update to 3.43
- Critical9.8SQL Injection
Daily Edition
≤1.6.2No patch available
- Critical9.0SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<3.8.8Update to 3.8.8
- Medium5.5Authenticated Stored Cross-Site Scripting
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤5.3.2Update to 5.3.3
- High7.3Missing Authorization
IgnitionDeck Crowdfunding Platform
≤1.1.6Update to 1.1.7
- Low3.1Cross-Site Request Forgery
All-In-One Security (AIOS) – Security and Firewall
≤3.8.9Update to 3.9.0
- Critical9.8Privilege Escalation
Ya'aburnee - Magazine & E-Commerce Theme | News / Editorial
≤1.0.7No patch available
- Medium6.1Cross-Site Scripting
WP Plugin Info Card – Showcase Beautiful Plugin Cards, Theme Cards, and GitHub Repos Anywhere
<2.3.7Update to 2.3.7
- Medium4.3Cross-site request forgery via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php
Contact Form DB
≤2.8.29Update to 2.8.32
- Critical9.8Arbitrary File Upload
DesignFolio Pllus
all versionsNo patch available
- Medium5.3CAPTCHA Bypass
reCaptcha by BestWebSoft
<1.13Update to 1.13
- Critical9.8Cross-Site Request Forgery to SQL Injection
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤1.0.11Update to 1.0.12
- Medium5.4Authorization Bypass
WPML Multilingual CMS
<3.1.9Update to 3.1.9.1
- Critical9.8SQL Injections
IP Blacklist Cloud
<3.41Update to 3.41
- Medium6.1Reflected Cross-Site Scripting
WP All Import Pro
≤4.1.1Update to 4.1.2
- Critical9.8Arbitrary File Upload
Gravity Forms
<1.8.20Update to 1.8.20
- High8.83.0.20 - Privilege Escalation
WP EasyCart: Shopping Cart and eCommerce Store
1.1.30 – 3.0.20Update to 3.0.21
- Medium6.1Cross-Site Scripting
WP Media Cleaner
≤2.2.6Update to 2.4.0
- High8.2Unauthenticated Blind SQL Injection
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<3.9.6Update to 3.9.6
- Medium6.1Cross-Site Scripting
EZ Portfolio (Unmaintained)
<1.0.2Update to 1.0.2
- High7.5Information Disclosure
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
<3.6.75Update to 3.6.75
- Medium6.5Authenticated Cross-Site Scripting
Contact Form DB
≤2.8.26Update to 2.8.28
- Medium5.5Cross-Site Scripting
AdPlugg WordPress Ad Plugin
<1.1.34Update to 1.1.34
- High8.8SQL Injection
Gallery Bank – WordPress Photo Gallery Plugin
≤3.0.101Update to 3.0.102
- High7.1Multiple Cross-Site Scripting
WonderPlugin Audio Player
<2.1Update to 2.1