Database
WordPress Vulnerability Database (page 102)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
Smart Slider 3
≤3.5.1.38Update to 3.5.1.39
- High7.5Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
Motors – Car Dealership & Classified Listings Plugin
≤1.4.109Update to 1.4.110
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤3.1.1Update to 3.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter
Bold Page Builder
≤5.7.2Update to 5.7.3
- High7.5Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
Simply Schedule Appointments
≤1.6.12.27Update to 1.6.12.33
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms
≤1.3.4Update to 1.3.5
- Medium4.3Missing Authorization
AllAble Connector
≤0.13.4Update to 0.13.6
- Medium5.3Unauthenticated Information Exposure
BackupEase – Scheduled Backup, Restore & Site Migration
≤2.2.2Update to 2.2.3
- Medium5.3Unauthenticated Information Exposure
StifLi Backup Tools
≤2.2.7Update to 2.2.8
- Critical9.8Unauthenticated Remote Code Execution
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP
≤2.1.8Update to 2.2.0
- Medium6.5Authenticated (Contributor+) Path Traversal
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators
≤1.2.19Update to 1.2.20
- Medium4.3Missing Authorization
MCP Content Manager Lite
≤1.1.0Update to 1.2.0
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Music Player for WooCommerce
≤1.9.1Update to 1.9.2
- High7.5Authenticated (Subscriber+) PHP Object Injection
WPBot – ChatBot Conversational Forms
≤1.5.0Update to 1.5.1
- Medium4.3Missing Authorization
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
≤1.12.2Update to 1.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
JW Player for WordPress
≤2.3.11Update to 2.3.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Geo Mashup
≤1.13.21Update to 1.13.22
- Medium5.3Missing Authorization
WP Express Checkout (Fast Payments via PayPal & Stripe)
≤2.4.9Update to 2.5.0
- Medium6.6Authenticated (Editor+) PHP Object Injection
Responsive Slider Gallery – Responsive Image Photo Slider
≤1.5.5Update to 1.5.6
- High7.5Unauthenticated SQL Injection
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.3Update to 4.8.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
oik
≤4.15.4Update to 4.16.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Download Manager
≤3.3.70Update to 3.3.71
- Medium5.33.47.14 - Missing Authorization
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
3.37.14 – 3.47.14Update to 3.48.0
- High8.1Authenticated (Author+) Arbitrary File Deletion
WEBO MCP
≤3.0.18Update to 3.0.22
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixfort Core
<4.3.3Update to 4.3.3
- Medium5.3Unauthenticated Information Exposure
Payments for Hubtel
≤1.0.1Update to 1.0.2