Database
WordPress Vulnerability Database (page 109)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Listing Admin+) Stored Cross-Site Scripting
WP Directory Kit
≤1.5.7Update to 1.5.8
- High7.2Unauthenticated Stored Cross-Site Scripting
LayerSlider
≤8.4.0Update to 8.4.1
- Medium5.3Missing Authorization
Blocksy Companion
≤2.1.55Update to 2.1.56
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.14.3Update to 3.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
ThemeREX Addons
<2.45.0Update to 2.45.0
- Medium5.3Unauthenticated User Impersonation
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.0Update to 6.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.85Update to 51.1.86
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.5.1Update to 6.5.2
- Medium6.5Authenticated (Editor+) Arbitrary File Deletion
Template Kit – Import
≤1.0.16Update to 1.0.17
- Medium4.3Cross-Site Request Forgery
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium5.3Missing Authorization
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.2Update to 4.0.3
- High7.5Authenticated (Contributor+) PHP Object Injection
Go Live Update Urls
≤7.0.8Update to 7.1.0
- High7.5Authenticated (Contributor+) PHP Object Injection
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.33.6Update to 2.34.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤8.3.1Update to 8.3.2
- High7.5Authenticated (Contributor+) PHP Object Injection
GEO Plugin by Squirrly SEO
≤14.2.5Update to 14.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.13Update to 14.16.14
- High7.2Unauthenticated Stored Cross-Site Scripting
Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت
≤6.3Update to 6.4
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Import and export users and customers
≤2.5.2Update to 2.5.4
- High7.5Unauthenticated Arbitrary File Read
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.5.0Update to 4.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
≤1.10.7Update to 1.10.8
- Medium6.1Reflected Cross-Site Scripting
File Manager
≤8.0.4Update to 8.0.5
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium4.3Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
MailerLite – Signup forms (official)
≤1.7.21Update to 1.7.22
- Medium6.5Missing Authorization to Unauthenticated Settings Export and Settings Reset
Custom Thank You Page for WooCommerce
≤1.1.2Update to 1.1.3