Database
WordPress Vulnerability Database (page 1042)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Shortcodes Ultimate – Content Elements
≤5.13.3Update to 7.0.0
- Medium5.3Missing Authorization
Participants Database
≤2.5.5Update to 2.5.6
- High7.2Authenticated (Administrator+) Arbitrary File Upload
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
≤1.0.76Update to 1.0.77
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Long Form
≤2.2.2No patch available
- High7.2Authenticated (Shop Manager+) Arbitrary File Upload
Mollie Payments for WooCommerce
≤7.3.11Update to 7.3.12
- Medium5.3Missing Authorization via init
YASR – Yet Another Star Rating Plugin for WordPress
≤3.4.3Update to 3.4.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
Qode Essential Addons
≤1.5.2Update to 1.5.3
- Medium4.3Insecure Direct Object Reference to Information Disclosure
Shortcodes Ultimate – Content Elements
≤5.13.3Update to 7.0.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
SoundCloud Shortcode
≤3.1.0Update to 4.0.0
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
12 Step Meeting List
≤3.14.24Update to 3.14.25
- Critical9.8Unauthenticated SQL Injection
My Calendar – Accessible Event Manager
≤3.4.21Update to 3.4.22
- Critical9.8Unauthenticated Arbitrary File Upload
JobSearch WP Job Board
≤2.3.3Update to 2.3.4
- Medium6.4Authenticated (Admin+) Remote Code Execution
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
<1.4.1Update to 1.4.1
- Medium4.3Cross-Site Request Forgery via add_availability_calendar_create_admin_page()
Availability Calendar
≤1.2.6No patch available
- Medium5.5Authenticated (Seo Manager+) Stored Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤21.0Update to 21.1
- High8.8Cross-Site Request Forgery to PHAR Deserialization
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
<1.4.1Update to 1.4.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Chatbot for WordPress by Collect.chat ⚡️
2.3.9 – 2.3.9Update to 2.4.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Order Information Disclosure
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤7.1.1Update to 7.1.2
- Medium6.1Reflected Cross-Site Scripting
Community by PeepSo – Download from PeepSo.com
≤6.2.6.0Update to 6.2.7.0
- Critical9.8Authentication Bypass
JobSearch WP Job Board
≤2.3.3Update to 2.3.4
- Medium5.3Captcha Bypass
Captcha Code
≤2.9Update to 3.0
- High8.8Cross-Site Request Forgery to Remote Code Execution
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
<1.4.1Update to 1.4.1
- Medium5.4Authenticated (Contributor+) Arbitrary File Upload
Vrm 360 3D Model Viewer
≤1.2.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Salient Core
≤2.0.2Update to 2.0.3
- High7.5Sensitive Information Exposure via Directory Listing
Prime Mover – Backup and Migration
≤1.9.2Update to 1.9.3
- Medium4.3Missing Authorization to Product Creation/Modification
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤7.1.2Update to 7.1.3
- Medium6.1Reflected Cross-Site Scripting
Simply Exclude
≤2.0.6.6No patch available
- Medium5.42FA Bypass via Brute Force
Theme My Login 2fa
<1.2Update to 1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Salient Core
≤2.0.2Update to 2.0.3
- Medium4.3#1 Mail SMTP Plugin for WordPress <= 4.0.14 - Missing Authorization
Mail Bank – #1 Mail SMTP Plugin for WordPress
≤4.0.14No patch available