Database
WordPress Vulnerability Database (page 1077)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Product Manipulation
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent header
User Activity Log Pro
≤2.3.3Update to 2.3.4
- High7.2Authenticated (Admin+) PHAR Deserialization
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.38Update to 3.39
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer
Page Builder: Pagelayer – Drag and Drop website builder
≤1.7.7Update to 1.7.8
- Medium6.6Authenticated(Administrator+) SQL Injection
Online Scheduling and Appointment Booking System – Bookly
≤22.3.1Update to 22.4
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Title Exposure
ActivityPub
≤0.17.0Update to 1.0.0
- Medium4.3Missing Authorization to Product Manipulation
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- High8.8Account Takeover via Password Reset
Simple Membership
≤4.3.4Update to 4.3.5
- Medium6.5Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Content Exposure
ActivityPub
≤0.17.0Update to 1.0.0
- Medium6.5Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.37Update to 3.39
- Medium5.4Cross-Site Request Forgery to Product Deletion
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.3Update to 1.1.4
- Medium6.1Reflected Cross-Site Scripting via webhook
WP Discord Invite
≤2.4.1Update to 2.5.1
- Medium5.4Cross-Site Request Forgery via update_blacklist_manual
Comment Blacklist Updater
<1.2.0Update to 1.2.0
- Medium4.3Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval
Brands for WooCommerce
<3.8.2.3Update to 3.8.2.3
- High7.2Authenticated (Admin+) SQL injection
iPanorama 360 – Advanced Virtual Tour Builder
<1.8.0Update to 1.8.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Contact Form by FormGet – Best Form Builder Plugin for WordPress
≤5.5.5No patch available
- Medium5.3Insecure Direct Object Reference to Arbitrary Post '_ppc_meta_key' Update
Pre-Publish Checklist
<1.1.2Update to 1.1.2
- High8.7Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal
WPvivid — Backup, Migration & Staging
0.9.89 – 0.9.89Update to 0.9.90
- Medium4.3DoFollow Case by Case <= 3.4.2 Cross-Site Request Forgery via getEmail and getUrl
DoFollow Case by Case
<3.5.0Update to 3.5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple CAPTCHA with Cloudflare Turnstile
≤1.23.1Update to 1.23.2
- Medium4.3Cross-Site Request Forgery
Brands for WooCommerce
<3.8.2.3Update to 3.8.2.3
- Medium5.3Unauthenticated Sensitive Information Exposure via ai_ajax
Ad Inserter – Ad Manager & AdSense Ads
≤2.7.30Update to 2.7.31
- Medium4.3Authenticated (Subscriber+) Information Disclosure via Shortcode
Easy Registration Forms
≤2.1.1No patch available
- Medium4.3Missing Authorization
Astra Bulk Edit
<1.2.8Update to 1.2.8
- Medium4.4Authenticated Stored Cross-Site Scripting
WPvivid — Backup, Migration & Staging
≤0.9.89Update to 0.9.90
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Mailto Links – Protect Email Addresses
≤3.1.3Update to 3.1.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WPvivid — Backup, Migration & Staging
≤0.9.89Update to 0.9.90
- Medium5.3Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe
Ad Inserter – Ad Manager & AdSense Ads
≤2.7.30Update to 2.7.31
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Copy Anything to Clipboard for WordPress – Copy Button, Copy Text & Copy Code
≤2.6.4Update to 2.6.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Media Library Assistant
≤3.10Update to 3.11