Database
WordPress Vulnerability Database (page 106)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP YouTube Lyte
≤1.7.30Update to 1.7.31
- High7.5Unauthenticated SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤8.0.2Update to 8.0.3
- High7.5Unauthenticated SQL Injection
SPS-Suite
≤1.4.0No patch available
- Medium5.34.13.0 - Missing Authorization
Verge3D Publishing and E-Commerce
4.1.0 – 4.13.0Update to 4.13.1
- Medium5.3Unauthenticated Information Exposure
Verge3D Publishing and E-Commerce
≤4.13.0Update to 4.13.1
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- High7.53.7.49 - Authenticated (Contributor+) Local File Inclusion
MasterStudy LMS WordPress Plugin – for Online Courses and Education
3.5.29 – 3.7.49Update to 3.7.50
- Medium4.32.3.1 - Blocked User Restriction Bypass
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification
1.3.0 – 2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Payment Bypass
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Download Manager
≤7.5.5Update to 7.5.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
EmbedPress
≤4.6.6Update to 4.6.7
- Medium6.42.8.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
2.8.12 – 2.8.18Update to 2.8.19
- Medium5.3Unauthenticated Insecure Direct Object Reference
Mailchimp for WooCommerce
≤6.2Update to 6.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
Post Voting System
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- High7.528.2 - Authenticated (Bookly Administrator+) PHP Object Injection
Online Scheduling and Appointment Booking System – Bookly
23.2 – 28.2Update to 28.3
- High7.5Unauthenticated SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.84Update to 5.5.85
- Medium6.3Authenticated (Contributor+) Privilege Escalation
WPeMatico RSS Feed Fetcher
≤2.8.26Update to 2.8.27
- Medium4.31.26.7 - Authenticated (Subscriber+) Information Exposure
UpdraftPlus Premium
<2.26.8.26Update to 1.26.8 or 2.26.8.26
- High7.2Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration
Zero Spam for WordPress
≤5.7.10Update to 5.7.11
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
wpForo Forum
≤3.1.6Update to 3.1.7
- Medium6.1Reflected Cross-Site Scripting via 'page_title' POST Parameter
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤2.0.2Update to 2.0.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
Premium Packages – Sell Digital Products Securely
≤7.2.1Update to 7.2.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.8Update to 5.0.0
- High7.5Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.8Update to 5.0.0
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter
Asset CleanUp: Page Speed Booster
≤1.4.0.5Update to 1.4.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
Themify Builder
≤7.8.1Update to 7.8.2
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter
SSL Zen — SSL Certificate Installer & HTTPS Redirects
≤4.7.42Update to 4.7.43
- Medium6.1Reflected Cross-Site Scripting via 'uri' Parameter
SSL Zen — SSL Certificate Installer & HTTPS Redirects
≤4.7.42Update to 4.7.43