Database
WordPress Vulnerability Database (page 234)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
WP Meta SEO
≤4.5.18No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging
WP Meta SEO
≤4.5.18No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute
WP Latest Posts
≤5.0.11No patch available
- High8.8Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method
Welcome Software Publishing
≤0.0.31No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
MIR blocks and shortcodes
≤1.0.0No patch available
- High7.2Unauthenticated Server-Side Request Forgery via 'url' Parameter
URL Preview
≤1.0No patch available
- High7.2Unauthenticated Server-Side Request Forgery via 'api_url' Parameter
Kargo Takip
≤1.2No patch available
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter
Advanced Contact Form 7 – Compact DB
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Bulk SEO Image
≤1.1No patch available
- Medium4.3Cross-Site Request Forgery via 'blcap_action' Parameter
Blue Captcha
≤2.0.1Update to 2.1.0
- Medium4.3Cross-Site Request Forgery to Settings Update
MotorDesk
≤1.1.2Update to 1.1.3
- Medium4.3Cross-Site Request Forgery to Settings Update
Book a Room Event Calendar
≤1.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Avalon23 Products Filter for WooCommerce
≤1.1.6Update to 1.1.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action
Generate Security.txt
≤1.0.13Update to 1.0.14
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action
Reviews and Rating – Docplanner
≤1.1.4No patch available
- Medium5.3Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs
WhatsOrder – Instant Checkout for WooCommerce
≤1.0.1No patch available
- Medium6.1Reflected Cross-Site Scripting via PHP_SELF Parameter
EntreDroppers
≤1.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting via PHP_SELF Server Variable
Image Sizes on Demand
≤1.3No patch available
- Medium5.3Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint
Devs Accounting – Simple Accounting and Invoicing Solution
≤1.2.0Update to 1.2.1
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter
Devs Accounting – Simple Accounting and Invoicing Solution
≤1.2.0Update to 1.2.1
- High7.5Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint
WP Forms Connector
≤1.8No patch available
- High7.5Unauthenticated SQL Injection via 'order' Parameter
WP Forms Connector
≤1.8No patch available
- Medium4.3Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action
24liveblog – live blog tool
≤2.2No patch available
- Medium4.3Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization
24liveblog – live blog tool
≤2.2No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter
Osiris Signature Banner
≤0.5No patch available
- Medium5.3Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action
RentMy Real-Time Rental Management Plugin
≤4.0.4.1No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action
Advance Nav Menu Manager
≤1.3No patch available
- Medium5.3Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions
SearchPlus
≤1.7.1Update to 1.9
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX Action
Assistio
≤1.1.2No patch available
- Medium5.3Missing Authorization to Unauthenticated Account Logout via 'secuforoauth_unregister_action' AJAX Action
Secufor_OAuth
≤1.0.7No patch available