Database
WordPress Vulnerability Database (page 245)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters
Animation Addons – Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates
≤4.2.6Update to 4.2.7
- High7.5Unauthenticated SQL Injection
apptha-slider-gallery
≤1.0No patch available
- High7.5Unauthenticated SQL Injection
WP Support Plus Responsive Ticket System
≤9.1.2No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Simple Personal Message
≤1.0.3No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.2Update to 4.3.3
- High8.8Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field
Blocksy
≤2.1.41Update to 2.1.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings
Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages
≤1.3.3Update to 1.3.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field
MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
≤2.0.4Update to 2.0.5
- Medium6.57.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure
Slider Revolution
7.0 – 7.0.10Update to 7.0.11
- High8.8Authenticated (Subscriber+) Privilege Escalation
Events Calendar for GeoDirectory
≤2.3.28Update to 2.3.29
- Medium6.1Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter
Product Filter Widget for Elementor
≤1.0.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
kk blog card
≤1.3No patch available
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
jQuery Hover Footnotes
≤1.4No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax)
jQuery Hover Footnotes
≤1.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute
TinyMCE shortcode Addon
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Global Body Mass Index Calculator
≤1.2Update to 1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
WP ApplicantStack Jobs Display
≤1.1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
RomanCart Ecommerce
≤2.0.8No patch available
- High8.1Unauthenticated Local File Inclusion via 'tpf' Parameter
Recover Exit For WooCommerce
≤1.0.3No patch available
- High7.5Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter
6Storage Rentals
≤2.26.0Update to 2.27.0
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
WP Meta Sort Posts
≤0.9No patch available
- Medium6.1Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter
WP Emoticon Rating
≤1.0.1No patch available
- Medium4.3Cross-Site Request Forgery via save_general_settings Action
WpMobi
≤0.0.3No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter
WP-Ultimate-Map
≤1.1No patch available
- Medium4.3Cross-Site Request Forgery via Settings Save
FastPicker, an order picker and order management system (oms) for WooCommerce on steroids
≤1.0.2No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
AJAX Report Comments
≤2.0.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Extra Settings for RocketChat
≤0.1No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX Action
WP GDPR Cookie Consent
≤1.0.0No patch available
- Medium5.3Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings Update
Helpfulcrowd Product Reviews
≤1.2.9Update to 1.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'publicationid' Shortcode Attribute
Plugin Name: ePaperFlip Publisher
≤1No patch available