Database
WordPress Vulnerability Database (page 216)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters
多说社会化评论框
≤1.2No patch available
- High7.5Unauthenticated Arbitrary File Read via 'url' Parameter
Jssor Slider by jssor.com
≤3.1.24No patch available
- High8.8Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter
Widget Logic Visual
≤1.52No patch available
- Medium6.6Authenticated (Administrator+) PHP Object Injection
Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials
≤3.1.15Update to 3.1.16
- Medium6.1Reflected Cross-Site Scripting
Simple File List
≤6.3.8Update to 6.3.9
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
PhotoSwipe
≤4.1.1.1No patch available
- Medium5.3Unauthenticated Payment Bypass
Events Made Easy
≤3.1.1Update to 3.1.2
- Medium6.1Reflected Cross-Site Scripting
Visitor Traffic Real Time Statistics pro
≤11.9.1Update to 11.9.2
- Medium5.3Missing Authorization
PayU India
<3.9.0Update to 3.9.0
- High7.2Unauthenticated Stored Cross-Site Scripting
FunnelKit Funnel Builder Pro
≤3.15.0.7Update to 3.15.0.8
- High8.8Authenticated (Contributor+) Privilege Escalation
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
<2.9.1Update to 2.9.1
- Medium6.1Reflected Cross-Site Scripting
Database for Contact Form 7, WPforms, Elementor forms
≤1.5.2Update to 1.5.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Property Hive
≤2.2.3Update to 2.2.4
- Medium6.1Reflected Cross-Site Scripting
Noo JobMonster
≤4.8.5Update to 4.8.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form to Chat Apps | Click to Chat to Order – FormyChat
≤2.15.3Update to 2.15.4
- Medium4.3Missing Authorization
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.1.4Update to 11.1.5
- Medium5.3Unauthenticated Business Logic Flaw
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More
≤2.2.0Update to 2.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Extensions for Leaflet Map
≤5.1Update to 5.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Subscription Payment Tampering
FluentCart – Online Store Builder & eCommerce Checkout
≤1.3.0Update to 1.4.0
- Medium5.3Missing Authorization
Advanced Forms for ACF
≤1.9.3.7Update to 1.9.3.8
- Medium5.3Missing Authorization
WowAddons – Product Addons and Product Options With Custom Fields
≤1.6.8Update to 1.6.9
- High7.2Unauthenticated Stored Cross-Site Scripting
ElementInvader Addons for Elementor
≤1.4.3Update to 1.4.4
- Medium5.3Missing Authorization
MStore API – Create Native Android & iOS Apps On The Cloud
≤4.18.4Update to 4.19.0
- Medium5.3Missing Authorization
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
≤1.1.30Update to 1.1.31
- High7.2Unauthenticated Stored Cross-Site Scripting
JobSearch WP Job Board
≤3.2.9Update to 3.3.0
- High7.2Unauthenticated Server-Side Request Forgery
WPJAM Basic
≤7.0Update to 7.0.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Event Tickets and Registration
≤5.28.3Update to 5.28.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Themify Builder
≤7.7.4Update to 7.7.5
- High7.5Authenticated (Contributor+) PHP Object Injection
WPJAM Basic
≤7.0Update to 7.0.1
- Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
FunnelKit Funnel Builder Pro
≤3.15.0.4Update to 3.15.0.5