Database
WordPress Vulnerability Database (page 1426)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Multiple Cross-Site Scripting
bSuite
≤5 alpha 2Update to 5 alpha 3
- Medium5.3Limited Local File Inclusion
DZS Video Gallery
<7.95Update to 7.95
- High7.25.0.6 - Cross-Site Scripting
Easy Forms for Mailchimp
3.0 – 5.0.6Update to 5.0.7
- High8.8Arbitrary File Upload
Frontend File Manager Plugin
<3.6Update to 3.6
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
I Recommend This – Love/Like Button for WordPress Posts
≤3.7.2Update to 3.7.3
- Critical9.8SQL Injection
I Recommend This – Love/Like Button for WordPress Posts
<3.7.3Update to 3.7.3
- High7.4Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters
All-In-One Security (AIOS) – Security and Firewall
<3.8.3Update to 3.8.3
- Medium4.3Reflected Cross-Site Scripting
MaxButtons – Create buttons
<1.26.1Update to 1.26.1
- High7.3Authorization Bypass
MailPoet Newsletters (Previous)
≤2.6.7Update to 2.6.8
- Medium6.3Cross-Site Request Forgery
MailPoet Newsletters (Previous)
<2.6.11Update to 2.6.11
- Critical9.8SQL Injection
gallery-objects
≤0.4No patch available
- Critical9.8Arbitrary File Upload
Konzept - Fullscreen Portfolio WordPress Theme
all versionsNo patch available
- Medium5.3Improper Input Validation
WP-Ban
<1.64Update to 1.64
- Medium6.1Cross-Site Scripting
Ready! Google Maps
≤1.1.5Update to 1.1.6
- High7.1Cross-Site Scripting
Login Widget With Shortcode
<3.2.1Update to 3.2.1
- Medium6.3Multiple Cross-Site Request Forgery
Disqus Comment System
<2.79Update to 2.79
- Critical9.8Missing Authorization
Custom Contact Forms
<5.1.0.4Update to 5.1.0.4
- Medium6.1Cross-Site Scripting
2Way VideoCalls and Random Chat – HTML5 Webcam Videochat
≤4.41Update to 4.41.2
- Critical9.1Arbitrary File Deletion
FormCraft
≤2.0.5No patch available
- Medium6.11.6.1 - Cross-Site Scripting
Cakifo
1.0 – 1.6.1Update to 1.6.2
- High8.8Cross-Site Request Forgery
WP RSS Multi Importer
<3.14Update to 3.14
- Medium6.1Cross-Site Request Forgery and Cross-Site Scripting
Ready! Ecommerce Shopping Cart
<0.5.1Update to 0.5.1
- Medium6.4Stored Cross-Site Scripting
WP Photo Album Plus
≤5.4.7Update to 5.4.8
- Medium6.1Reflected Cross-Site Scripting
WooCommerce
<2.2.3Update to 2.2.3
- High7.3Cross-Site Scripting via range Parameter
WooCommerce
<2.2.3Update to 2.2.3
- Medium6.5Multiple Protection Mechanism Bypasses
Wordfence Security – Firewall, Malware Scan, and Login Security
<5.2.4Update to 5.2.4
- High7.2Stored Cross-Site Scripting via REQUEST_URI
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.2.3Update to 5.2.4
- Medium5.3Full Path Disclosure
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- Critical9.8SQL Injection
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- Medium6.2Arbitrary File Download
Urban City
all versionsNo patch available