Database
WordPress Vulnerability Database (page 73)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Authenticated (Admin+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
<4.1.0Update to 4.1.0
- Medium4.3Missing Authorization
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Mobile builder
≤1.4.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Prenotazioni
≤1.7.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Piotnet Forms
≤1.0.30No patch available
- Medium6.1Reflected Cross-Site Scripting
Subscribe to Comments
≤2.3.2Update to 2.3.3
- High7.5Unauthenticated SQL Injection
paymendo – Bank Transfer (Lite)
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
WP Verify API
≤1.0.0No patch available
- High7.5Unauthenticated SQL Injection
ASPL Product Quotation
≤1.1.0No patch available
- High7.5Unauthenticated SQL Injection
WpCues Basic Quiz
≤1.6.5No patch available
- High7.5Unauthenticated SQL Injection
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Topcontent
≤1.2.1No patch available
- Low3.1Information Exposure
Simple Membership
≤4.8.2Update to 4.8.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Adwised Web Push Notification
≤2.5.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Web Vitals Tracking
≤5.4.2No patch available
- High8.8Authenticated (Crowdfundly Manager+) Privilege Escalation
Crowdfundly
≤2.2.2No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Freeton WP
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
click5 CRM add-on to Contact Form 7
≤1.0.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
click5 CRM add-on to Ninja Forms
≤1.0.1No patch available
- Medium4.3Missing Authorization to Settings Update
Directory Listings WordPress plugin – uListing
≤2.2.0No patch available
- Medium4.3Cross-Site Request Forgery
Dashboard Notes
≤1.0.3No patch available
- Medium4.3Authenticated (Author+) Insecure Direct Object Reference
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Medium4.3Missing Authorization
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- High7.5Unauthenticated SQL Injection
Mobile builder
≤1.4.2No patch available
- Medium6.8Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
Redux Framework
≤4.5.11Update to 4.5.13
- High7.3Unauthenticated Privilege Escalation
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.7Update to 5.5.8
- High7.3Unauthenticated Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.3Update to 1.58.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
Ocean Pro Demos
≤1.5.4Update to 1.5.5
- High8.1Unauthenticated Local File Inclusion
Ozeum | Art Gallery and Museum Theme
≤1.3.0No patch available
- High8.1MegaOne Multipurpose WordPress Theme <= 2.8 - Unauthenticated Local File Inclusion
Flipmart - MegaOne Multipurpose WordPress Theme
≤2.8No patch available