Database
WordPress Vulnerability Database (page 108)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Insecure Direct Object Reference
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High8.8Authenticated (Contributor+) Remote Code Execution
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.2.0Update to 3.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Table & List Builder for WooCommerce
≤5.6.7Update to 5.6.9
- Medium5.3Missing Authorization
Testimonials Widget
≤4.0.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
YITH WooCommerce Ajax Search
≤2.28.0Update to 2.28.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Simply Schedule Appointments
≤1.6.12.31Update to 1.6.12.33
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.27Update to 6.4.28
- Medium4.3Authenticated (Contributor+) Information Exposure
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium4.3Missing Authorization
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium6.3Authenticated (Shop Worker+) Privilege Escalation
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.7.2Update to 4.7.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
ThemeREX Addons
<2.45.0Update to 2.45.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Sprout Invoices – Client Invoicing & Estimates
≤20.8.17Update to 20.8.18
- High7.2Unauthenticated Stored Cross-Site Scripting
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
≤1.26.15Update to 1.26.16
- Medium4.3Cross-Site Request Forgery
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification
≤2.3.1Update to 2.3.2
- Medium6.6Authenticated (Editor+) PHP Object Injection
Ultra Addons for Contact Form 7
≤3.5.51Update to 3.5.52
- Medium6.3Authenticated (Subscriber+) Security Control Bypass
All-In-One Security (AIOS) – Security and Firewall
≤5.4.8Update to 5.4.9
- Medium5.3Missing Authorization
Customer Reviews for WooCommerce
≤5.120.0Update to 5.121.0
- High7.2Unauthenticated Server-Side Request Forgery
Testimonials Widget
≤4.0.4No patch available
- Medium6.44.2.12 - Authenticated (Author+) Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
4.0.0 – 4.2.12Update to 4.2.13
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Estatik Real Estate Plugin
≤4.3.5Update to 4.3.6
- High7.5Unauthenticated Denial of Service
WP Store Locator
<3.0.0Update to 3.0.0
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Kadence WooCommerce Email Designer
≤1.5.19.1Update to 1.5.19.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing
≤1.69.0Update to 1.69.1
- Medium5.3Missing Authorization
Simply Schedule Appointments
≤1.6.12.29Update to 1.6.12.31
- Medium5.3Unauthenticated Payment Bypass
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.25Update to 4.6.26
- Medium6.52.0.2 - Unauthenticated Arbitrary Shortcode Execution
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.5.0.1 – 2.0.2Update to 2.0.2.1
- High8.15.3.6 - Unauthenticated Local File Inclusion
WebFacing™ – Email Accounts management for cPanel®
5.3 – 5.3.6Update to 5.4
- Medium5.38.0.4 - Unauthenticated Information Exposure
File Manager
7.2.2 – 8.0.4Update to 8.0.5