Database
WordPress Vulnerability Database (page 109)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated Denial of Service
WP Store Locator
<3.0.0Update to 3.0.0
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Kadence WooCommerce Email Designer
≤1.5.19.1Update to 1.5.19.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing
≤1.69.0Update to 1.69.1
- Medium5.3Missing Authorization
Simply Schedule Appointments
≤1.6.12.29Update to 1.6.12.31
- Medium5.3Unauthenticated Payment Bypass
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.25Update to 4.6.26
- Medium6.52.0.2 - Unauthenticated Arbitrary Shortcode Execution
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.5.0.1 – 2.0.2Update to 2.0.2.1
- High8.15.3.6 - Unauthenticated Local File Inclusion
WebFacing™ – Email Accounts management for cPanel®
5.3 – 5.3.6Update to 5.4
- Medium5.38.0.4 - Unauthenticated Information Exposure
File Manager
7.2.2 – 8.0.4Update to 8.0.5
- Medium6.4Authenticated (Listing Admin+) Stored Cross-Site Scripting
WP Directory Kit
≤1.5.7Update to 1.5.8
- High7.2Unauthenticated Stored Cross-Site Scripting
LayerSlider
≤8.4.0Update to 8.4.1
- Medium5.3Missing Authorization
Blocksy Companion
≤2.1.55Update to 2.1.56
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
ThemeREX Addons
<2.45.0Update to 2.45.0
- Medium5.3Unauthenticated User Impersonation
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.0Update to 6.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.85Update to 51.1.86
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.5.1Update to 6.5.2
- Medium6.5Authenticated (Editor+) Arbitrary File Deletion
Template Kit – Import
≤1.0.16Update to 1.0.17
- Medium4.3Cross-Site Request Forgery
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium5.3Missing Authorization
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- High7.5Authenticated (Contributor+) PHP Object Injection
Go Live Update Urls
≤7.0.8Update to 7.1.0
- High7.5Authenticated (Contributor+) PHP Object Injection
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.33.6Update to 2.34.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤8.3.1Update to 8.3.2
- High7.5Authenticated (Contributor+) PHP Object Injection
GEO Plugin by Squirrly SEO
≤14.2.5Update to 14.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.13Update to 14.16.14