Database
WordPress Vulnerability Database (page 1425)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
O2tweet
≤0.0.4No patch available
- Medium6.1Reflected Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<6.0.27Update to 6.0.27
- Medium6.1Cross-Site Scripting
cforms
<10.5Update to 10.5
- Medium6.1Cross-Site Scripting
cforms
≤10.1Update to 10.2
- Critical9.8SQL Injection
YourMembers
≤3.0No patch available
- High8.8Command Injection
WP-DBManager
<2.72Update to 2.72
- Medium6.5Arbitrary File Read
WP-DBManager
<2.7.2Update to 2.7.2
- High7.8OS Command Injection
WP-DBManager
<2.72Update to 2.72
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Simple Sticky Footer
≤1.3.2Update to 1.3.3
- Critical9.8Arbitrary File Upload
Work The Flow File Upload
≤2.3.1Update to 2.3.2
- Medium6.1Cross-Site Scripting
Contact Form DB
≤2.8.19Update to 2.8.20
- Medium6.1Reflected Cross-Site Scripting
EWWW Image Optimizer
≤2.0.1Update to 2.0.2
- Medium6.1Reflected Cross-Site Scripting
Simple Calendar – Google Calendar, Events, & ICS Feeds
<2.0.4Update to 2.0.4
- Medium6.1Reflected Cross-Site Scripting
Titan Framework
<1.6Update to 1.6
- High8.8SQL Injection
BulletProof Security
<.51.1Update to .51.1
- Critical9.8Unspecified Vulnerability
enfold
<3.0.1Update to 3.0.1
- Medium5.31.3.10 - Multiple Cross-Site scripting
Contact Form 7 Integrations
1.0 – 1.3.10Update to 1.3.11
- Critical9.81.5.10 - Arbitrary File Upload
Infusionsoft Gravity Forms Add-on
1.5.3 – 1.5.10Update to 1.5.11
- Critical9.8SQL Injection
WP eCommerce
<3.8.7.6Update to 3.8.7.6
- High7.2Authenticated (Admin+) SQL Injection
Content Audit
<1.6.1Update to 1.6.1
- Medium6.1Stored Cross-Site Scripting
Subscribe2 – Form, Email Subscribers & Newsletters
<10.16Update to 10.16
- Low3.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.1.30Update to 1.1.31
- Medium4.8Cross-Site Scripting
BulletProof Security
<.52.5Update to .52.5
- Critical9.8Arbitrary File Upload and Deletion
Category and Page Icons
≤0.9.1Update to 0.9.2
- High8.8SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
≤3.1.0No patch available
- High7.5Unauthenticated Arbitrary File Read
NativeChurch
≤1.6.1Update to 1.6.2
- Medium6.1Multiple Cross-Site Scripting
bSuite
≤5 alpha 2Update to 5 alpha 3
- High7.2Stored Cross-Site Scripting via HTTP_HOST
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.2.3Update to 5.2.4
- Medium5.3Limited Local File Inclusion
DZS Video Gallery
<7.95Update to 7.95
- Critical10.0Multiple Vulnerabilities
Refraction
≤1.3No patch available