Database
WordPress Vulnerability Database (page 104)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Custom Role+) PHP Object Injection
eCommerce Product Catalog
≤3.6.0Update to 3.6.1
- High7.5Authenticated (Custom Role+) PHP Object Injection
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.9Update to 1.17.10
- High7.5Authenticated (Contributor+) PHP Object Injection
DesignSetGo
≤2.8.0Update to 2.8.1
- Medium5.3Missing Authorization
GravityExport Lite for Gravity Forms
≤2.7.2Update to 2.7.3
- Medium5.31.9.7 - Missing Authorization
InPost PL
1.7.5 – 1.9.7Update to 1.9.8
- Medium6.12.8.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Mobile Menu – The Mobile-Friendly Responsive Menu
2.7.4 – 2.8.8Update to 2.9
- High7.58.7.7 - Authenticated (Author+) PHP Object Injection
EWWW Image Optimizer
8.6.0 – 8.7.7Update to 8.8.0
- Medium5.32.0.6 - Unauthenticated Access Mode Bypass
WPEPP – All In One WordPress Security, Firewall, Malware Scanner & Login Protection
2.0.0 – 2.0.6Update to 2.0.7
- Medium4.3Missing Authorization
Vayu X
≤1.0.5Update to 1.0.6
- Medium5.3Unauthenticated Information Exposure
Connections Business Directory
≤10.4.67No patch available
- High7.22.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
All in One Files Upload for WooCommerce
2.0.3 – 2.0.16Update to 2.0.17
- Medium5.33.2.9 - Unauthenticated Information Exposure
New User Approve
3.1.0 – 3.2.9Update to 3.2.10
- Medium5.3Unauthenticated Information Exposure
Solace Extra
≤1.7.1Update to 1.7.2
- Medium4.3Authenticated (Subscriber+) Subscription-Gated Post Creation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium5.34.3.11 - Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
2.5.8 – 4.3.11Update to 4.3.12
- Medium4.7Cross-Site Scripting to Unauthenticated Arbitrary HTML Content Injection in Admin Log
WP Mail Logging
≤1.16.0Update to 1.17.0
- High7.3Unauthenticated Unauthorized Customer Account Access
FluentCart – Online Store Builder & eCommerce Checkout
≤1.6.4Update to 1.6.5
- Medium5.32.0.5 - Unauthenticated Arbitrary Payment Amount Reduction
Easy PayPal & Stripe Buy Now Button
1.8 – 2.0.5Update to 2.0.6
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Schema & Structured Data for WP & AMP
≤1.66Update to 1.67
- High7.22.0.0 - Unauthenticated Server-Side Request Forgery
Broken Link Notifier
1.3.1 – 2.0.0Update to 2.0.0.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
YITH WooCommerce Tab Manager
≤2.15.0Update to 2.15.1
- Medium5.3Unauthenticated Information Exposure
Course Booking System
≤7.0.8Update to 7.0.9
- High7.5Authenticated (Contributor+) PHP Object Injection
Themify Builder
≤7.8.1Update to 7.8.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.12Update to 2.0.15
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.3.9Update to 6.4.0
- Medium4.3Missing Authorization
MakeCommerce for WooCommerce
≤4.1.0Update to 4.1.1
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Vitepos – Point of Sale (POS) for WooCommerce
≤3.5.0Update to 3.5.1
- Medium5.3Unauthenticated Information Exposure
WPMobile.App – Android and iOS App Builder
≤11.83Update to 11.84
- Medium4.32.1.3 - Missing Authorization
Media Library Organizer – Folders, File Manager & Media Categories
2.0.4 – 2.1.3Update to 2.1.4
- Medium5.31.4.0 - Unauthenticated Information Exposure
YayReviews – Advanced Customer Reviews for WooCommerce
1.0.4 – 1.4.0Update to 1.4.1