Database
WordPress Vulnerability Database (page 312)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Handmade Framework
≤3.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Podlove Podcast Publisher
≤4.3.3Update to 4.3.4
- Medium4.3Missing Authorization
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback
≤4.3.2Update to 4.3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Themify Event Post
≤1.3.4Update to 1.3.5
- Medium5.3Missing Authorization
Asset CleanUp: Page Speed Booster
≤1.4.0.3Update to 1.4.0.4
- Medium4.3Missing Authorization
Elementor Website Builder – more than just a page builder
≤3.35.5Update to 3.35.6
- Medium4.3Missing Authorization
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤1.9.9.3Update to 1.9.9.4
- High7.2Authenticated (Contributor+) Arbitrary File Deletion
Meta Box – A Framework for Dynamic Websites
≤5.11.1Update to 5.11.2
- Medium6.1Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content
≤5.0.11Update to 5.0.12
- High7.2Unauthenticated Stored Cross-Site Scripting via 'app-bar-features' Parameter
WP App Bar
≤1.5No patch available
- Medium4.3Cross-Site Request Forgery to Unauthorized True Ranker Disconnection
TrueRanker
≤2.2.9Update to 2.3.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
LotekMedia Popup Form
≤1.0.6No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Carta Online
≤2.13.0Update to 2.15.0
- Medium4.3Cross-Site Request Forgery to Settings Update
Font Pairing Preview For Landing Pages
≤1.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Show YouTube video
≤1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Infomaniak Connect for OpenID
≤1.0.2No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Purchase Button For Affiliate Link
≤1.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'list_title' Shortcode Attribute
DA Media GigList
≤1.9.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute
Consensus Embed
≤1.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_id' Shortcode Attribute
Media Library Alt Text Editor
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MyQtip – easy qTip2
≤2.0.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
Wueen
≤0.2.0No patch available
- High8.8Authenticated (Author+) Privilege Escalation
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.3.20Update to 7.3.21
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion
MDJM Event Management
≤1.7.8.1Update to 1.7.8.2
- Medium4.8Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
MailArchiver
≤4.4.0Update to 4.5.0
- High7.5Unauthenticated SQL Injection via 'zipcode' Parameter
ZIP Code Based Content Protection
≤1.0.2Update to 1.0.3
- Medium4.9Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field
Community Events
≤1.5.8Update to 1.5.9
- High7.5Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute
JS Archive List
≤6.1.7Update to 6.2.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
ProfileGrid – User Profiles, Groups and Communities
≤5.9.8.1Update to 5.9.8.2
- Medium4.3Cross-Site Request Forgery to Group Membership Request Approval/Denial
ProfileGrid – User Profiles, Groups and Communities
≤5.9.8.2Update to 5.9.8.3