Database
WordPress Vulnerability Database (page 101)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Qi Addons For Elementor
≤1.11Update to 1.11.1
- Medium6.1Reflected Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.1Update to 3.13.2
- High7.2Authenticated (Shop Manager+) Arbitrary CSS Injection
Astra
≤4.13.12Update to 4.14.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
≤2.5.63Update to 2.5.64
- Medium4.7Unauthenticated Open Redirect
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
≤1.12.26Update to 1.12.27
- Medium5.3Unauthenticated Information Exposure
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.3Update to 4.2.4
- Medium4.3Cross-Site Request Forgery
Razorpay Payment Links for WooCommerce
≤2.1.5Update to 2.2.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Media Library Assistant
≤3.41Update to 3.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP OAuth Server (OAuth Authentication)
≤4.5.1Update to 4.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Strong Testimonials
≤3.3.11Update to 3.3.12
- Medium5.3Unauthenticated Insecure Direct Object Reference
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
≤3.1.0Update to 3.1.1
- Medium4.3Missing Authorization
Prevent Files / Folders Access
≤2.6.7Update to 2.6.8
- Medium4.34.22.0 - Authenticated (Subscriber+) Payment Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
4.21.1 – 4.22.0Update to 4.22.1
- Medium6.5Authenticated (Author+) SQL Injection
Quiz Cat – WordPress Quiz Plugin
≤3.1.1Update to 3.2.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium6.4Authenticated (Listing Manager+) Stored Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
≤1.4.123Update to 1.4.124
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20260810Update to 20260916
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.23.1Update to 3.50.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.105Update to 4.11.106
- Medium4.9Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
WPML Multilingual & Multicurrency for WooCommerce
≤5.5.7Update to 5.5.8
- Medium4.3Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
≤1.21.0Update to 1.21.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CF7 Views – Complete Entry Management for Contact Form 7
≤3.2.5Update to 3.2.6
- High7.5Unauthenticated Denial of Service
Two Factor
≤0.16.0Update to 0.17.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
ReactPress
≤3.4.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Viable URL Media Uploader
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Post Views Stats Counter
≤1.1.7No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter
Real Estate Manager – Property Listing and Agent Management
≤7.3Update to 7.4
- High7.5Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
Product Designer App
≤1.1.3No patch available
- Medium6.5Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
WP Directory Kit
≤1.5.4Update to 1.5.5