Database
WordPress Vulnerability Database (page 278)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes
Gutentools
≤1.1.3Update to 1.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute
Gallagher Website Design
≤2.6.4Update to 2.6.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
Emailchef
≤3.5.1Update to 3.5.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting
Short Comment Filter
≤2.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting
Private WP suite
≤0.4.1No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via Settings
Real Estate Pro
≤1.0.9No patch available
- High7.2Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
HTTP Headers
≤1.19.2Update to 1.19.3
- Medium5.5Authenticated (Administrator+) CRLF Injection via Custom Header Values
HTTP Headers
≤1.19.5No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting
HTTP Headers
≤1.19.4Update to 1.19.5
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute
Table Manager
≤1.0.0Update to 1.0.1
- Critical9.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php
Create DB Tables
≤1.2.1No patch available
- Medium5.3Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action
CalJ Shabbat Times
≤1.5Update to 2.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action
TP Restore Categories And Taxonomies
≤1.0.1No patch available
- Medium6.1Cross-Site Request Forgery via Settings Form
Inquiry cart
≤3.4.2No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter
WP Responsive Popup + Optin
≤1.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
CI HUB Connector
≤1.2.106Update to 1.2.108
- Medium4.3Cross-Site Request Forgery to Settings Update
TextP2P Texting Widget
≤1.8Update to 1.9
- Medium4.3Cross-Site Request Forgery to Settings Update
Kcaptcha
≤1.0.1No patch available
- Medium4.3Cross-Site Request Forgery via Settings Update
Call To Action Plugin
≤3.1.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Twittee Text Tweet
≤1.0.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Bread & Butter – Identify Website Visitors, Score Leads & Gate Content
≤8.6.0.107Update to 8.7.0.139
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Switch CTA Box
≤1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode Attribute
Easy Social Photos Gallery – MIF
≤3.1.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slider Bootstrap Carousel
≤1.0.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
ER Swiffy Insert
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Quran Live Multilanguage
≤1.0.3No patch available
- Medium4.3Cross-Site Request Forgery via compute_post() Function
mCatFilter
≤0.5.2No patch available
- Medium4.3Cross-Site Request Forgery via Settings Update
DX Unanswered Comments
≤1.7Update to 1.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' Field
Sentence To SEO (keywords, description and tags)
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action
Ni WooCommerce Order Export
≤3.1.6No patch available