Database
WordPress Vulnerability Database (page 73)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Information Exposure
All Bootstrap Blocks
≤1.3.31No patch available
- Medium4.3Missing Authorization
Before After Image Comparison – Visual Comparison for Two Images
≤1.1.21Update to 1.1.22
- Critical9.8Unauthenticated Privilege Escalation
Tonda Membership
≤1.0.1No patch available
- Medium4.3Missing Authorization
Asgaros Forum
≤3.4.0No patch available
- Medium5.3Unauthenticated Denial of Service
WooCommerce Bookings
≤3.10.0Update to 3.11.0
- Medium4.9Authenticated (Admin+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
<4.1.0Update to 4.1.0
- Medium4.3Missing Authorization
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Mobile builder
≤1.4.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Prenotazioni
≤1.7.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Piotnet Forms
≤1.0.30No patch available
- Medium6.1Reflected Cross-Site Scripting
Subscribe to Comments
≤2.3.2Update to 2.3.3
- High7.5Unauthenticated SQL Injection
paymendo – Bank Transfer (Lite)
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
WP Verify API
≤1.0.0No patch available
- High7.5Unauthenticated SQL Injection
ASPL Product Quotation
≤1.1.0No patch available
- High7.5Unauthenticated SQL Injection
WpCues Basic Quiz
≤1.6.5No patch available
- High7.5Unauthenticated SQL Injection
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Topcontent
≤1.2.1No patch available
- Low3.1Information Exposure
Simple Membership
≤4.8.2Update to 4.8.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Adwised Web Push Notification
≤2.5.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Web Vitals Tracking
≤5.4.2No patch available
- High8.8Authenticated (Crowdfundly Manager+) Privilege Escalation
Crowdfundly
≤2.2.2No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Freeton WP
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
click5 CRM add-on to Contact Form 7
≤1.0.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
click5 CRM add-on to Ninja Forms
≤1.0.1No patch available
- Medium4.3Missing Authorization to Settings Update
Directory Listings WordPress plugin – uListing
≤2.2.0No patch available
- Medium4.3Cross-Site Request Forgery
Dashboard Notes
≤1.0.3No patch available
- Medium4.3Authenticated (Author+) Insecure Direct Object Reference
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Medium4.3Missing Authorization
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- High7.5Unauthenticated SQL Injection
Mobile builder
≤1.4.2No patch available
- Medium6.8Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
Redux Framework
≤4.5.11Update to 4.5.13