Database
WordPress Vulnerability Database (page 1076)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Product Manipulation
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- High7.2Authenticated(Teacher+) SQL Injection via ClassID
School Management System – WPSchoolPress
≤2.2.4Update to 2.2.5
- Medium4.3Cross-Site Request Forgery to Profile Deletion
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- High8.8Account Takeover via Password Reset
Simple Membership
≤4.3.4Update to 4.3.5
- Medium4.3Cross-Site Request Forgery to Profile Creation
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Title Exposure
ActivityPub
≤0.17.0Update to 1.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent header
User Activity Log Pro
≤2.3.3Update to 2.3.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Options for Twenty Seventeen
≤2.5.0Update to 2.5.1
- Medium4.3Missing Authorization to Product Manipulation
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer
Page Builder: Pagelayer – Drag and Drop website builder
≤1.7.7Update to 1.7.8
- Medium4.3Cross-Site Request Forgery to Product Manipulation
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Modal Window – create popup modal window
≤5.3.5Update to 5.3.6
- Medium4.3Cross-Site Request Forgery to Stored Cross-Site Scripting
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode
iframe
≤4.6Update to 4.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
ActivityPub
≤0.17.0Update to 1.0.0
- Medium4.3Cross-Site Request Forgery to Product Manipulation
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium4.3Missing Authorization to Product Manipulation
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium4.3Cross-Site Request Forgery to Product Manipulation
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Low3.7Information Exposure
HireZoot – Job Listings, Career Page & Recruitment Tool
≤3.4.2Update to 3.4.3
- High7.2Missing Authorization to Stored Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
≤1.7.6Update to 1.7.7
- High7.3Privilege escalation via Registration
Simple Membership
≤4.3.4Update to 4.3.5
- Medium6.5Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.37Update to 3.39
- Medium6.6Authenticated(Administrator+) SQL Injection
Online Scheduling and Appointment Booking System – Bookly
≤22.3.1Update to 22.4
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Simple Posts Ticker – Easy, Lightweight & Flexible
≤1.1.5Update to 1.1.6
- Medium5.4Cross-Site Request Forgery to Product Deletion
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium5.4Missing Authorization to Product Deletion
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via pretty_google_calendar shortcode
Pretty Google Calendar
<1.6.0Update to 1.6.0
- Medium6.5Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Content Exposure
ActivityPub
≤0.17.0Update to 1.0.0
- Medium5.4Cross-Site Request Forgery to Product Deletion
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium5.3Tracking Bypass via IP Spoofing
User Activity Log Pro
≤2.3.3Update to 2.3.4