Database
WordPress Vulnerability Database (page 1088)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Lasso Lite – Affiliate Link Manager, URL Shortener & Link Tracking
≤118Update to 119
- Medium4.3Cross-Site Request Forgery to Account Lock/Unlock
Lock User Account
≤1.0.3Update to 1.0.4
- Medium5.3IP Address Spoofing
DoLogin Security
<3.7Update to 3.7
- High7.3Privilege Escalation
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.0.17Update to 3.0.18
- Medium6.1Reflected Cross-Site Scripting
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
≤8.3.4Update to 8.3.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Event Tickets with Ticket Scanner
<1.5.5Update to 1.5.5
- Medium4.4Authenticated (Administrator+) Cross-Site Scripting
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤1.2.90Update to 1.2.91
- Medium5.3Sensitive Information Exposure
Cookies and Content Security Policy
≤2.15Update to 2.16
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Donations Made Easy – Smart Donations
≤4.0.12No patch available
- Medium4.3Missing Authorization to Sensitive Information Exposure
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤1.2.91Update to 1.2.92
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
<3.7.1Update to 3.7.1
- Medium5.4Unauthenticated Open Redirect
DOOFINDER Search and Discovery for WP & WooCommerce
≤1.5.49Update to 2.0.0
- Medium4.3Cross-Site Request Forgery
CLUEVO LMS, E-Learning Platform
≤1.10.0Update to 1.11.0
- High7.2Unauthenticated Stored Cross-Site Scripting
tagDiv Composer
≤4.1Update to 4.2
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
BigBlueButton
≤3.0.0-beta.4No patch available
- Medium5.3Insufficient Authorization
Paid Memberships Pro CCBill Gateway
≤0.3Update to 0.4
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
tagDiv Composer
≤4.1Update to 4.2
- Critical9.8Unauthenticated Privilege Escalation
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.7.0.12Update to 1.7.0.13
- High7.2Reflected Cross-Site Scripting
Cleverwise Daily Quotes
≤3.2No patch available
- Medium5.3Missing Authorization to Arbitrary Order Status Modification
Payment Gateway of Stripe for WooCommerce
3.7.9 – 3.7.9Update to 3.8.0
- High7.2Reflected Cross-Site Scripting
Estatik Mortgage Calculator
≤2.0.11No patch available
- Medium4.3Authenticated (Contributor+) Content Injection
Tabs & Accordion
≤1.3.10No patch available
- Medium5.3Missing Authorization
Simple Org Chart
≤2.3.4Update to 2.3.5
- High7.2Authenticated (Administrator+) Arbitrary File Upload
JS Help Desk – AI-Powered Support & Ticketing System
≤2.7.7Update to 2.7.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Serial Codes Generator and Validator with WooCommerce Support
<2.4.15Update to 2.4.15
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
RSVPMaker
≤10.6.5Update to 10.6.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Typing Effect
≤1.3.6Update to 1.3.7
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Simple Staff List
≤2.2.3Update to 2.2.4
- Critical9.8Unauthenticated SQL Injection via 'post'
Contact form 7 Custom validation
≤1.1.3No patch available
- High7.2Authenticated (Administrator+) Remote Code Execution
Kanban Boards for WordPress
≤2.5.21No patch available