Database
WordPress Vulnerability Database (page 339)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter
Link Hopper
≤1.4Update to 3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute
Ravelry Designs Widget
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute
UpMenu – Online ordering for restaurants
≤3.1Update to 3.2
- Critical9.8Unauthenticated Arbitrary File Upload via 'export' AJAX Action
midi-Synth
≤1.1.0Update to 2.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field
Chatbot for WordPress by Collect.chat ⚡️
≤2.4.8Update to 2.4.9
- Medium6.1Reflected Cross-Site Scripting
Geo Widget
≤1.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block
Press3D
≤1.0.2Update to 1.1.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure
Smart Forms – when you need more than just a contact form
≤2.6.100Update to 2.6.101
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter
User Language Switch
≤1.6.10No patch available
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter
User Language Switch
≤1.6.10No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter
Payment Page – Stripe Payment Forms for Donations, Subscriptions & Recurring Payments
≤1.4.6Update to 1.4.7
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
MDirector Newsletter WordPress Plugin
≤4.5.8Update to 4.5.9
- Medium5.3Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection
MailChimp Campaigns
≤3.2.4No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
WP Quick Contact Us
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Percent to Infograph
≤1.0No patch available
- Medium5.4Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification
Scheduler Widget
≤0.1.6No patch available
- Medium6.1Reflected Cross-Site Scripting
Address Bar Ads
≤1.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
StyleBidet
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
QuestionPro Surveys
≤1.0No patch available
- High7.2Reflected Cross-Site Scripting via 'sscf_name' Parameter
Super Simple Contact Form
≤1.6.2No patch available
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute
Sphere Manager
≤1.0.2No patch available
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update
CallbackKiller service widget
≤1.2No patch available
- Medium4.3Cross-Site Request Forgery
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.11Update to 3.7.12
- High7.5Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute
Flexi Product Slider and Grid for WooCommerce
≤1.0.5No patch available
- Medium5.4Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification
Accordion and Accordion Slider
≤1.4.5Update to 1.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.63Update to 5.5.64
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions
Allow HTML in Category Descriptions
≤1.2.4Update to 1.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute
ZoomifyWP Free
≤1.1No patch available
- High7.5Unauthenticated Stripe Payment Amount Manipulation
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.2.1Update to 2.2.2