Database
WordPress Vulnerability Database (page 340)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Disclosure via Chat Message Interception
One to one user Chat by WPGuppy
≤1.1.4Update to 1.1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute
Simple Plyr
≤0.0.1No patch available
- High7.5Unauthenticated SQL Injection via 'postid' Parameter
PhotoStack Gallery
≤0.4.1No patch available
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification
Appointment Booking Calendar Plugin – Bookr
≤1.0.2No patch available
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute
Simple Wp colorfull Accordion
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
personal-authors-category
≤0.3No patch available
- High8.1Unauthenticated Privilege Escalation via Insecure QR Code File Storage
Magic Login Mail or QR Code
≤2.05Update to 2.06
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via AMP Custom CSS Setting
AMP Enhancer – Compatibility Layer for Official AMP Plugin
≤1.0.49No patch available
- High7.5Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation
BlueSnap Payment Gateway for WooCommerce
≤3.4.0Update to 3.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute
Citations tools
≤0.3.2No patch available
- Medium4.3Cross-Site Request Forgery to Arbitrary Event Deletion
SEATT: Simple Event Attendance
≤1.5.0No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'message'
Easy Voice Mail
≤1.2.5Update to 1.2.6
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
≤3.9.3Update to 3.9.4
- Medium4.9Authenticated (Administrator+) Path Traversal via 'first_file' Parameter
BFG Tools – Extension Zipper
≤1.0.7Update to 1.0.8
- Medium5.3Unauthenticated Information Disclosure
StickEasy Protected Contact Form
≤1.0.1Update to 1.0.2
- High8.8Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults
Starfish Review Generation & Marketing for WordPress
≤3.1.19Update to 3.1.20
- High7.2Unauthenticated Stored Cross-Site Scripting
PixelYourSite Pro – Your smart PIXEL (TAG) Manager
≤12.4.0.2Update to 12.4.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
PixelYourSite – Your smart PIXEL (TAG) & API Manager
≤11.2.0Update to 11.2.0.1
- Medium4.3Cross-Site Request Forgery
Grand Car Rental | Limousine HTML Template
≤3.6.9No patch available
- Medium4.3Cross-Site Request Forgery
Grand Portfolio WordPress
≤3.3No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Share This Image
≤2.14Update to 2.15
- Critical9.8Unauthenticated Arbitrary Options Update
PowerPack for LearnDash
≤1.2.0Update to 1.3.0
- Medium4.3Missing Authorization
School Management System – WPSchoolPress
≤2.2.36No patch available
- Medium5.3Missing Authorization
Mogi - A Creative Portfolio / Agency WordPress Theme
≤1.2.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤3.35.5Update to 3.35.6
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
≤1.4.2Update to 1.5.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
PowerPress Podcasting plugin by Blubrry
≤11.15.13Update to 11.15.14
- Medium5.3Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification
WP Last Modified Info
≤1.9.5Update to 1.9.6
- Medium4.3Cross-Site Request Forgery
Grand Blog WordPress
≤3.1No patch available
- Medium4.3Cross-Site Request Forgery to Coupon Deletion
WP eCommerce
≤3.15.1No patch available