Database
WordPress Vulnerability Database (page 1079)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.9Authenticated (Subscriber+) Remote Code Execution via Shortcode
Allow PHP in Posts and Pages
≤3.0.4No patch available
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Horizontal scrolling announcement
≤9.2No patch available
- High8.8Authenticated(Editor+) SQL Injection
Welcart e-Commerce
<2.8.22Update to 2.8.22
- Medium6.6Authenticated(Editor+) PHP Object Injection
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
<5.4.2Update to 5.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WS Facebook Like Box Widget
≤5.0No patch available
- High8.8Authenticated (Contributor+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤5.8.8Update to 5.8.9
- High8.8Authenticated(level_5+) SQL Injection via get_logs
Welcart e-Commerce
<2.8.22Update to 2.8.22
- Medium4.3Missing Authorization on Dashboard Widget
DoLogin Security
<3.7.1Update to 3.7.1
- Medium6.6Authenticated(Author+) PHP Object Injection
Enable Media Replace
<4.1.3Update to 4.1.3
- Medium4.3Missing Authorization to Notice Dismissal
10Web Map Builder for Google Maps
<1.0.74Update to 1.0.74
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Feeds for YouTube (YouTube video, channel, and gallery plugin)
≤2.1Update to 2.1.2
- High8.1Unauthenticated PHP Object Injection via products
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤4.2.0Update to 4.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Awesome Weather Widget
≤3.0.2No patch available
- Medium4.3Missing Authorization to Authenticated (Contributor+) EAN Update
WooCommerce EAN Payment Gateway
<6.1.0Update to 6.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
<1.7.7Update to 1.7.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Customer Reviews
≤3.6.6Update to 3.6.7
- Medium4.3Missing Authorization to Authenticated (Contributor+) CVR Update
WooCommerce CVR Payment Gateway
<6.1.0Update to 6.1.0
- Medium4.3Authenticated (Subscriber+) Information Disclosure via Shortcode
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤7.1.0Update to 7.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤7.1.0Update to 7.1.1
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL
PowerPress Podcasting plugin by Blubrry
<11.0.12Update to 11.0.12
- High8.1Unauthenticated PHP Object Injection via queries
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤4.2.0Update to 4.2.1
- Medium5.3Insecure Direct Object Reference to Post Rating Increase/Decrease
Comments – wpDiscuz
≤7.6.3Update to 7.6.4
- High8.6Improper Authorization on REST Routes via 'save_settings_permission'
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
<4.0.26Update to 4.0.26
- High8.8Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation
BAN Users
≤1.5.3No patch available
- High7.2Multiple Authenticated(Editor+) SQL Injection
Booking calendar, Appointment Booking System
<3.2.9Update to 3.2.9
- Medium5.3Insecure Direct Object Reference to Comment Rating Increase/Decrease
Comments – wpDiscuz
≤7.6.3Update to 7.6.4
- Medium5.3Insecure Password Reset Mechanism
WP User Control
≤1.5.3No patch available
- High7.2Authenticated (Administrator+) SQL Injection
WooCommerce Beta Tester
<2.2.4Update to 2.2.4
- Medium5.3Authenticated (Subscriber+) Sensitive Information Exposure
Leyka
≤3.30.7Update to 3.30.7.1
- Medium6.4Authenticated (Client+) Stored Cross-Site Scripting
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
≤5.5.0Update to 5.5.1