Database
WordPress Vulnerability Database (page 265)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to Arbitrary Game/Post Deletion
Games Catalog
≤1.2.0No patch available
- Medium6.1Reflected Cross-Site Scripting via 'page' Parameter
VatanSMS WP SMS
≤1.01No patch available
- High8.8Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation
Account Switcher
≤1.0.2No patch available
- Medium4.3Cross-Site Request Forgery to Settings Reset and Update
Bigfishgames Syndicate
≤1.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter
Anomify AI – Anomaly Detection and Alerting
≤0.3.6No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Bottom Bar
≤0.1.7No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update via Plugin Settings Form
Child Height Predictor by Ostheimer
≤1.3No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter
General Options
≤1.1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute
Sticky
≤2.5.6No patch available
- Medium6.1Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page
Word 2 Cash
≤0.9.2No patch available
- Medium5.4Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter
Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
≤1.1.1No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters
Sentence To SEO (keywords, description and tags)
≤1.0No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via 'files'
ProSolution WP Client
≤2.0.0Update to 2.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute
Faces of Users
≤0.0.3No patch available
- Medium6.5Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
Oliver POS – WooCommerce POS for iPhone, iPad & Android
≤2.4.2.6Update to 4.5.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter
診断ジェネレータ作成プラグイン
≤1.4.16No patch available
- High7.5Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.6Update to 6.0.7
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.6Update to 6.0.7
- Medium5.3Unauthenticated Payment Bypass
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤1.10.0.4Update to 1.10.0.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Activity Log
≤5.6.3Update to 5.6.3.1
- High7.5Unauthenticated SQL Injection
Active Woot Products Tables for WooCommerce. 100% FREE
≤1.0.8Update to 1.0.9
- Medium5.3Missing Authorization
Presto Player
≤4.1.3Update to 4.1.4
- Medium5.3Missing Authorization
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.15.0.2Update to 3.15.0.3
- High7.5Unauthenticated SQL Injection
Creative Mail – Easier WordPress & WooCommerce Email Marketing
≤1.6.9No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via Form File Upload
Piotnet Addons For Elementor Pro
≤7.1.70No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via Form File Upload
Piotnet Forms
≤2.1.40No patch available
- Medium5.3Missing Authorization
wpForo Forum
≤3.0.6Update to 3.0.7
- High7.5Unauthenticated SQL Injection
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤28.1.6Update to 28.1.7
- Medium6.1Reflected Cross-Site Scripting
E2Pdf – Export Pdf Tool for WordPress
≤1.32.14Update to 1.32.15
- High8.1Unauthenticated Local File Inclusion
Simple Fields
≤0.3.5No patch available