Database
WordPress Vulnerability Database (page 105)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Cost of Goods: Product Cost & Profit Calculator for WooCommerce
≤3.5.2Update to 4.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Notification for Telegram
≤3.5.2Update to 3.5.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Verge3D Publishing and E-Commerce
≤4.13.0Update to 4.13.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Content Egg – Affiliate Product Importer & Price Comparison
≤11.8.0Update to 11.9.0
- Medium4.7Authenticated (Administrator+) Cross-Site WebP File Deletion or Rename
EWWW Image Optimizer
≤8.7.0Update to 8.8.0
- Medium5.3Unauthenticated Arbitrary Gift Card Price Manipulation
WebToffee Gift Cards for WooCommerce
≤1.3.0Update to 1.3.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
Image Optimizer
≤1.7.6Update to 1.7.7
- High7.22.0.7 - Unauthenticated Stored Cross-Site Scripting
Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF
2.0.0 – 2.0.7Update to 2.0.8
- Medium4.3Missing Authorization
Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF
≤2.0.7Update to 2.0.8
- Medium6.41.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Hostinger Reach – AI-Powered Email Marketing for WordPress
1.0.6 – 1.8.2Update to 1.8.3
- Medium4.3Missing Authorization
All in One Files Upload for WooCommerce
≤2.0.16Update to 2.0.17
- Medium6.41.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Audio Player Block – Advanced Block for Embedding Audio Files
1.1.0 – 1.6.2Update to 1.6.3
- Medium6.44.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
EmbedPress
4.4.9 – 4.6.6Update to 4.6.7
- Medium6.56.17.5 - Unauthenticated Arbitrary Shortcode Execution
The Events Calendar
6.12.0 – 6.17.5Update to 6.17.5.1
- Critical9.8Unauthenticated Arbitrary File Upload
zella-theme
≤2.6.2Update to 2.6.3
- High7.34.3.11 - Unauthenticated Privilege Escalation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
3.5.29 – 4.3.11Update to 4.3.12
- Critical9.8Unauthenticated Arbitrary File Upload via Signature Form Field
Ultra Addons for Contact Form 7
≤3.5.50Update to 3.5.51
- Critical9.8Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.5Update to 5.5.6
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode
Groups – Memberships and Access Control
≤4.6.0Update to 4.7.0
- Critical9.8Unauthenticated Arbitrary File Upload via AJAX Popup Handler
Request a Quote for WooCommerce
≤2.9.2No patch available
- Medium6.4Unauthenticated Stored Cross-Site Scripting via REQUEST_URI
Automatic.css
4.0.0 – 4.0.0Update to 4.0.1
- High8.84.3.1 - Cross-Site Request Forgery via REST Nonce Bypass to Privilege Escalation
Elementor Website Builder – more than just a page builder
4.3.0 – 4.3.1Update to 4.3.2
- Medium6.48.7.5 - Authenticated (Author+) Stored Cross-Site Scripting
Optima Express IDX
8.6.0 – 8.7.5Update to 8.7.6
- Medium5.3Missing Authorization
WP Verify API
≤1.0.0No patch available
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPress Podcasting plugin by Blubrry
≤11.17.1Update to 11.17.2
- Medium4.3Missing Authorization
NextScripts: Social Networks Auto-Poster
≤4.4.7Update to 4.4.8
- Medium5.38.7.5 - Missing Authorization
Optima Express IDX
8.5.0 – 8.7.5Update to 8.7.6
- Medium6.5Missing Authorization
Malcure Malware Shield — Removal, Repair, Monitor
≤19.9.6Update to 19.9.7