Database
WordPress Vulnerability Database (page 1422)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Twimp WP
≤0.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
<5.1.5Update to 5.1.5
- Critical9.8SQL Injection
Feedweb
≤3.0.7Update to 3.0.8
- High7.5Arbitrary File Download
AJAX Store Locator
≤1.2No patch available
- Critical9.8Local File Inclusion
ChurcHope
≤2.1Update to 2.2
- Critical9.8Arbitrary File Upload
satoshi
≤2.0No patch available
- High7.2Stored Cross-Site Scripting
Shariff for WordPress
<1.0.8Update to 1.0.8
- Medium5.3CAPTCHA Bypass
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms
<4.0.7Update to 4.0.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Broken Link Checker
<1.10.2Update to 1.10.2
- Medium6.5Authorization Bypass
WP BackItUp Community Edition
≤1.9Update to 1.9.1
- Medium6.5Unauthenticated Arbitrary File Read
google-mp3-audio-player
≤1.0.11Update to 1.0.12
- High8.8SQL Injection
Cart66 Lite :: WordPress Ecommerce
<1.5.2Update to 1.5.2
- High7.2Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤8.4Update to 8.5
- Medium6.1Reflected Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<2.8.10Update to 2.8.10
- Critical9.8PHP Object Injection
InfiniteWP Client
≤1.3.7Update to 1.3.8
- Critical9.8Privilege Escalation
InfiniteWP Client
≤1.3.7Update to 1.3.8
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
≤2.0.6Update to 2.0.7
- High7.2JavaScript Injection
Rich Counter
<1.2.0Update to 1.2.0
- Medium5.3Full Path Disclosure
HTML5 MP3 Player with Playlist Free
≤2.7.0Update to 2.8.0
- Medium6.1Cross-Site Scripting
WP Symposium
≤14.10Update to 14.11
- Medium6.1Cross-Site Scripting
InstaSqueeze Sexy Squeeze Pages
all versionsNo patch available
- Low3.5Cross-Site Scripting
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤5.1.2Update to 5.1.3
- Medium6.5Open Redirection
wordpress-admanager
≤1.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Contact Form DB
<2.8.18Update to 2.8.18
- Critical9.9Authenticated SQL Injection
WP Symposium
<14.11Update to 14.11
- Critical9.8Arbitrary File Upload
Gallery Bank – WordPress Photo Gallery Plugin
<3.0.61Update to 3.0.61
- Critical9.8Arbitrary File Upload
Showbiz Pro Responsive Teaser WordPress Plugin
≤1.7.1No patch available
- Critical9.8Missing Authorization to Arbitrary File Upload
Showbiz Pro Responsive Teaser WordPress Plugin
<1.7.1Update to 1.7.1
- Critical9.8Arbitrary File Upload
wpDataTables (Premium)
<1.5.4Update to 1.5.4
- High8.1Authenticated Arbitrary Options Update
Download Manager
<2.7.3Update to 2.7.3