Database
WordPress Vulnerability Database (page 264)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Image Photo Gallery Final Tiles Grid
≤3.6.11Update to 3.6.12
- Medium6.1Reflected Cross-Site Scripting
ShareOpenly
<1.2.1Update to 1.2.1
- Medium4.3Missing Authorization
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager
≤1.2.9Update to 1.3.0
- Medium4.9Authenticated (Shop manager+) SQL Injection
YITH WooCommerce Product Add-Ons
≤4.29.0Update to 4.29.1
- Medium4.9Authenticated (Admin+) SQL Injection
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.2.0Update to 4.2.1
- Medium5.3Unauthenticated Sensitive Information Exposure via 'sliders/stream'
Slider Revolution
≤7.0.9Update to 6.7.55 or 7.0.10
- High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤10.8.2Update to 10.9.0
- Medium4.3Cross-Site Request Forgery
Anomify AI – Anomaly Detection and Alerting
≤0.3.6No patch available
- Medium6.4Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header
AI Copilot – Content Generator
≤1.4.14Update to 1.4.15
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.2.0Update to 4.2.1
- High8.8Authenticated (Subscriber+) Local File Inclusion via 'template'
Advanced Database Cleaner – Premium
≤4.1.0Update to 4.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import
Cost of Goods by PixelYourSite
≤1.2.12Update to 1.2.13
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤4.9.7Update to 4.9.7.1
- High7.5Unauthenticated Blind SQL Injection via Multiple Parameters
Boost
≤2.0.3Update to 2.0.4
- Critical9.8Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie
Boost
≤2.0.3Update to 2.0.4
- Medium5.3Missing Authorization to Unauthenticated Xpro Template Creation
Xpro Addons — 150+ Widgets for Elementor
≤1.5.0Update to 1.5.1
- Critical9.8Unauthenticated Privilege Escalation via easyel_handle_register
Easy Elements for Elementor – Addons & Website Templates
≤1.4.4Update to 1.4.5
- High7.5Unauthenticated SQL Injection via 'checkout_uuid' Parameter
Creative Mail – Easier WordPress & WooCommerce Email Marketing
≤1.6.9No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter
TypeSquare Webfonts for ConoHa
≤2.0.4No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Read More & Accordion
≤3.5.7No patch available
- High8.8Privilege Escalation via importData
Read More & Accordion
≤3.5.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Logo Manager For Enamad – لوگوی نماد الکترونیکی
≤0.7.4No patch available
- Medium6.1Reflected Cross-Site Scripting via PHP_SELF Parameter
Correct Prices
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting via PHP_SELF Parameter
SponsorMe
≤0.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting via PHP_SELF Parameter
LJ comments import: reloaded
≤0.97.1No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
Infility Global
≤2.15.19Update to 2.15.20
- Medium4.3Cross-Site Request Forgery
Remove Yellow BGBOX
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery
JaviBola Custom Theme Test
≤2.0.5No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
BLOGCHAT Chat System
≤1.3.6.3No patch available
- Medium4.3Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
Amazon Scraper
≤1.1No patch available