Database
WordPress Vulnerability Database (page 1427)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery leading to Stored Cross-Site Scripting
W3 Total Cache
≤0.9.4Update to 0.9.4.1
- Medium4.3Cross-Site Request Forgery
Advanced Editor Tools
<4.2.3Update to 4.2.3
- Critical9.8Arbitrary File Download
Epic Church by Organized Themes
≤3.6No patch available
- High7.2Stored Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
<5.2.3Update to 5.2.3
- Medium6.2Arbitrary File Download
Urban City
all versionsNo patch available
- High7.5Arbitrary File Download
Authentic
≤2.0.4No patch available
- High8.8SQL Injection
WDSocialWidgets
≤1.0.8Update to 1.0.9
- High8.8Responsive Photo Gallery <= 1.0.7 - SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.0.7Update to 1.0.8
- Medium6.1Ready! Coming Soon <= 0.5.0 Stored Cross-Site Scripting and Cross-Site Request Forgery
Ready! Coming Soon
<0.5.1Update to 0.5.1
- High8.8Cross-Site Request Forgery and Cross-Site Scripting
Easy Media Gallery Pro
≤1.2.59Update to 1.3.0
- Medium4.3Multiple Cross-Site Request Forgery
Gallery – Photo Albums Plugin
<1.3.03Update to 1.3.03
- High8.8Arbitrary File Upload
Slideshow Gallery LITE
<1.4.7Update to 1.4.7
- Medium5.3Security Bypass
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤2.9.2Update to 1.9.4 or 2.0.9 or 2.1.4 or 2.2.7 or 2.3.7 or 2.4.4 or 2.5.2 or 2.6.3 or 2.7.2 or 2.8.2 or 2.9.3
- Medium6.4Stored Cross-Site Scripting
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
≤1.7.5Update to 1.7.6
- Medium6.1Reflected Cross-Site Scripting
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
≤1.7.5Update to 1.7.6
- Medium6.1Cross-Site Scripting
Memphis Documents Library
<3.0Update to 3.0
- High7.5Path Traversal
kbslider
all versionsNo patch available
- Medium6.1Reflected Cross-Site Scripting
Iptanus File Upload
≤2.4.3Update to 2.4.4
- High7.2Arbitrary File Overwrite
Access Governance for WordPress (aka AAM)
<2.8.3Update to 2.8.3
- High7.5Directory Traversal
WP Source Control
<3.1.1Update to 3.1.1
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Improved user search in backend
≤1.2.5Update to 1.2.6
- Medium5.4Cross-Site Request Forgery
Disqus Comment System
<2.76Update to 2.76
- High8.3SQL Injection
GB Gallery Slideshow
<1.6Update to 1.6
- Medium6.1Cross-Site Scripting
MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps
<2.3.8Update to 2.3.8
- Medium6.3Cross-Site Request Forgery
Iptanus File Upload
<2.4.2Update to 2.4.2
- Medium6.5Unauthenticated Stored Cross-Site Scripting
Job Board by BestWebSoft
≤1.0.0Update to 1.0.1
- High7.1Reflected Cross-Site Scripting
SI Captcha Anti-spam
<2.7.6Update to 2.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.81Update to 3.82
- Medium6.1Cross-Site Scripting
PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin
<1.7.5Update to 1.7.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
BestWebSoft's Twitter
≤1.3.2Update to 1.3.7