Database
WordPress Vulnerability Database (page 243)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Arbitrary File Upload
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite.
≤1.0.7No patch available
- High8.1Unauthenticated PHP Object Injection
nifty
≤1.4.1Update to 1.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤9.17Update to 9.18
- High7.5Unauthenticated Arbitrary File Deletion
BookPro - Appointment Booking WordPress Plugin
≤1.1.0No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Fediverse Embeds
≤1.5.7Update to 1.5.9
- High7.5Unauthenticated Arbitrary File Download
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite.
≤1.0.7No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Fediverse Embeds
≤1.5.7Update to 1.5.9
- Medium4.3Authenticated (Contributor+) Information Exposure
Hash Elements
≤1.5.4Update to 1.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute
Presto Player
≤4.2.0Update to 4.2.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
YOOtheme Pro
≤5.0.34Update to 5.0.35
- High7.2Unauthenticated Stored Cross-Site Scripting
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
<7.8.4Update to 7.8.4
- High7.5Authenticated (Subscriber+) Local File Inclusion
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<4.9.3Update to 4.9.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Agile Store Locator
<1.6.6Update to 1.6.6
- Medium5.3Unauthenticated Payment Bypass
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.0Update to 5.2.0
- Medium5.3Unauthenticated Information Exposure
Fortis for WooCommerce
<1.3.1Update to 1.3.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Anti-Spam, Spam FireWall by CleanTalk
<6.79Update to 6.79
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Custom Block Builder – Lazy Blocks
<4.3.0Update to 4.3.0
- Medium6.1Reflected Cross-Site Scripting
EventPress
<22.2Update to 22.2
- High7.5Unauthenticated Information Exopsure
Decent Comments
<3.0.2Update to 3.0.2
- Medium4.3Authenticated (Contributor+) Information Exposure
Adminify – White Label, Admin Menu Editor, Login Customizer
≤4.2.9Update to 4.2.10
- Medium4.3Missing Authorization
Feeds for YouTube (YouTube video, channel, and gallery plugin)
<2.6.4Update to 2.6.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Email Encoder – Protect Email Addresses and Phone Numbers
<2.4.7Update to 2.4.7
- High7.5Unauthenticated SQL Injection
XStore
<9.7.3Update to 9.7.3
- Critical9.8Unauthenticated Backdoor
MonsterInsights Pro
10.2.0 – <11.0.0No patch available
- Medium5.3Unauthenticated Arbitrary Media Upload
Schema & Structured Data for WP & AMP
<1.60Update to 1.60
- High7.5Unauthenticated SQL Injection
WP Photo Album Plus
<9.1.11.001Update to 9.1.11.001
- Critical9.8Unauthenticated Authentication Bypass via UpdraftCentral udrpc
UpdraftPlus Premium
≤1.26.4Update to 1.26.5
- Medium4.7Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'
Open User Map PRO
≤1.4.31Update to 1.4.32
- High8.1Unauthenticated Privilege Escalation
Advanced Form Integration — Connect Forms to 300+ Apps
≤2.1.0Update to 2.1.1
- Medium4.3Cross-Site Request Forgery
WP Migrate Lite – Migration Made Easy
≤2.7.8Update to 2.7.9