Database
WordPress Vulnerability Database (page 251)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
JetSmartFilters
≤3.8.1Update to 3.8.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
HollerBox — Fast & Effective Popups & Lead-Generation
≤2.3.10.1Update to 2.3.11
- Medium4.3Missing Authorization
Employee, Leave and Recruitment Management System – Crew HRM
≤1.2.2Update to 1.2.3
- High8.8Authenticated (Subscriber+) Privilege Escalation
Booking for Appointments and Events Calendar – Amelia
≤2.3Update to 2.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.8.7Update to 7.8.8
- Medium5.3Unauthenticated Insecure Direct Object Reference
Simple Shopping Cart
≤5.2.9Update to 5.3.0
- Medium5.3Missing Authorization
Montonio for WooCommerce
≤10.1.2Update to 10.1.3
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'
Tiled Gallery Carousel Without JetPack
≤3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Easy Cart
≤1.8Update to 1.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'id' Parameter
FPW Category Thumbnails
≤1.9.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
ZeM STL
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery via BirdSeed Token Change
BirdSeed
≤2.2.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter
Word Replacer
≤0.4No patch available
- Medium6.1Reflected Cross-Site Scripting via 'new_domain' Parameter
hiWeb Migration Simple
≤2.0.0.1No patch available
- Medium6.1Reflected Cross-Site Scripting via 'a' Parameter
rognone
≤0.6.2No patch available
- Medium6.1Reflected Cross-Site Scripting via 'mode' Parameter
rognone
≤0.6.2No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole_link Parameter
WP Nano AD
≤1.31No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
DeMomentSomTres Shortcodes
≤1.1.1No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Remove NoFollow Commenter URL
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update via Settings Page
Google Plus One Bottom
≤0.0.2No patch available
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update via Settings Form
Laiser Tag
≤1.2.5No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions
JTL-Connector for WooCommerce
≤2.4.1Update to 2.4.2
- Medium4.3Cross-Site Request Forgery to Settings Update
Tectite Forms
≤1.3No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Remove meta boxes per user role
≤1.01No patch available
- Critical9.86.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Kirki – Freeform Page Builder, Website Builder & Customizer
6.0.0 – 6.0.6Update to 6.0.7
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Simple Custom Login Page
≤1.0.3Update to 1.0.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute
Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO)
≤4.9Update to 4.9.1
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation
Slider Revolution
≤7.0.14Update to 6.7.56 or 7.0.15
- Medium4.37.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure
Slider Revolution
7.0.0 – 7.0.14Update to 7.0.15
- High7.2Unauthenticated Stored Cross-Site Scripting
MW WP Form
≤5.1.3Update to 5.1.4