Database
WordPress Vulnerability Database (page 330)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Nanosoft - WP Theme for IT Solutions and Services Company
<1.3.2Update to 1.3.2
- Medium6.4Authenticated (Author+) Server-Side Request Forgery
URL Shortify – Simple and Easy URL Shortener
≤1.12.3Update to 1.12.4
- High7.5Authenticated (Contributor+) Local File Inclusion
LabtechCO | Laboratory & Science Research WordPress Theme
≤8.3Update to 8.4
- Medium4.3Cross-Site Request Forgery
Extra Fees for WooCommerce
≤4.3.3Update to 4.3.4
- High7.5Authenticated (Contributor+) Local File Inclusion
Greenly Theme Addons
<8.2Update to 8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes
Dealia – Request a quote
≤1.0.9No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Testimonial Heading' Setting
Client Testimonial Slider
≤2.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Enquiry Form Title' Setting
Institute Management – Learning Management System
≤5.5No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤260127Update to 260215
- High8.82.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function
IDonate – Blood Donation, Request And Donor Management System
2.1.5 – 2.1.9Update to 2.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode
XO Event Calendar
≤3.2.10No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters
YaMaps for WordPress Plugin
≤0.6.40Update to 0.6.41
- High7.2Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
WP Customer Reviews
≤3.7.5Update to 3.7.6
- Medium6.5Cross-Site Request Forgery to SQL Injection
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
≤21.0.8Update to 21.0.10
- Medium6.1Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
≤21.0.8Update to 21.0.10
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Email MFA Update
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
≤21.0.9Update to 21.0.10
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection
GEO Plugin by Squirrly SEO
≤12.4.14Update to 12.4.15
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.8.5Update to 7.8.6
- Low2.7Missing Authorization to Authenticated (Editor+) Plugin Settings Update
OneClick Chat to Order
≤1.0.9Update to 1.1.0
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'
xmlrpc attacks blocker
≤1.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters
Tennis Court Bookings
≤1.2.7No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Remove Post Type Slug
≤1.0.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter
salavat counter Plugin
≤0.9.5No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' Parameter
TalkJS
≤0.1.15Update to 0.1.16
- Medium6.1Reflected Cross-Site Scripting via 'iXML_email' Parameter
iXML – Google XML sitemap generator
≤0.6No patch available
- Medium4.3Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset
Dealia – Request a quote
≤1.0.7Update to 1.0.8
- Critical9.8Unauthenticated Arbitrary File Upload
Slider Future
≤1.0.5No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL
Easy Author Image
≤1.7No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings
Slidorion
≤1.0.2No patch available
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Data Loss
News Element – Magazine Blocks, Theme Builder, Mega Menu & Starter Sites
≤1.0.8Update to 1.0.9