Database
WordPress Vulnerability Database (page 107)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤260814Update to 260829
- High7.2Unauthenticated Stored Cross-Site Scripting via Repeater Field Value
Repeater Fields for Elementor Forms
≤2.2.7Update to 2.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Avatar Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- High7.3Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment
Optima Express IDX
≤8.7.5Update to 8.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter
Restaurant Menu and Food Ordering
≤2.4.14Update to 2.4.15
- High7.5Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.1Update to 3.0.2
- High8.1Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.2Update to 3.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter
Fancy Product Designer
≤6.5.2Update to 6.5.3
- High8.8Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
≤9.6.1.0Update to 9.6.2.0
- Medium6.1Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.3Update to 3.6.5.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.10.1Update to 2.10.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤4.0.8Update to 4.0.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.183Update to 2.8.184
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.181Update to 2.8.182
- High7.2Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta
Fancy Product Designer
≤6.5.2Update to 6.5.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint
OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA
≤1.1.7Update to 1.1.8
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
Customer Reviews for WooCommerce
≤5.120.0Update to 5.121.0
- Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.0.4Update to 3.0.5
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.0.4Update to 3.0.5
- Critical9.1Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium5.3Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers
Blog2Social: Social Media Auto Post & Scheduler
≤9.1.0Update to 9.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting via first_name Parameter
BA Book Everything
≤1.8.27Update to 1.8.28
- Critical9.8Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
Wawp Country Code & Chat Widget for WooCommerce
≤4.8.6Update to 4.8.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
AMP for WP – Accelerated Mobile Pages
≤1.1.16Update to 1.1.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode
CSS & JavaScript Toolbox
≤12.0.6Update to 12.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job
Fancy Product Designer
≤6.5.2Update to 6.5.3
- Medium4.3Authenticated (Subscriber+) Information Exposure
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High7.5Authenticated (Subscriber+) PHP Object Injection
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
≤6.5.5Update to 6.5.6