Database
WordPress Vulnerability Database (page 1094)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Shop Manager+) Missing Authorization to Arbitrary Options Update
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
7.0.0 – 7.0.0Update to 7.1.0
- Medium6.1Reflected Cross-Site Scripting
Bus Ticket Booking with Seat Reservation
≤5.2.3Update to 5.2.4
- Medium6.1Reflected Cross-Site Scripting
NOPARCELS / MultiParcels Shipping For WooCommerce
≤1.15.3Update to 1.15.4
- Critical9.8Unauthenticated Blind SQL Injection via Rest API
TI WooCommerce Wishlist
<2.7.4Update to 2.7.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple Blog Card
≤1.30Update to 1.31
- High8.8Authenticated (Subscriber+) Privilege Escalation
Shop as a Customer for WooCommerce
≤1.1.7Update to 1.1.8
- Medium5.4Missing Authorization via multiple AJAX functions
Short URL
≤1.6.7Update to 1.6.8
- Medium4.3Cross-Site Request Forgery
NOPARCELS / MultiParcels Shipping For WooCommerce
<1.15.2Update to 1.15.2
- Medium4.4Protected Shops <= 2.0 - Authenticated(Administrator+) Stored Cross-Site Scripting
wpShopGermany – Protected Shops
<2.1Update to 2.1
- Medium6.3Improper Privilege Management
Media from FTP
<11.16Update to 11.16
- High8.8Authenticated (Shop Manager+) Privilege Escalation
Shop as a Customer for WooCommerce
≤1.2.3Update to 1.2.4
- Medium5.4Authenticated(Contributor+) Missing Authorization
Schema Pro
≤2.7.8Update to 2.7.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist
≤1.1.8Update to 1.1.9
- Medium5.5Authenticated (Editor+) Server Side Request Forgery
Assistant – Every Day Productivity Apps
<1.4.4Update to 1.4.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Web Accessibility by accessiBe
≤1.15Update to 1.16
- Medium4.3Cross-Site Request Forgery on handle_installation function
Backup Migration
≤1.2.7Update to 1.2.8
- Medium5.3Protection Mechanism Failure to Login Page Disclosure
All In One Login
≤1.1.3Update to 1.1.4
- Medium4.3Missing Authorization on handle_installation function
Backup Migration
≤1.2.7Update to 1.2.8
- Medium5.3Missing Authorization to notice dimissal
Meks Smart Social Widget
≤1.6Update to 1.6.1
- Medium4.3Cross-Site Request Forgery
CartFlows Pro
≤1.11.12Update to 1.11.13
- Medium6.1Reflected Cross-Site Scripting
AGP Font Awesome Collection
≤3.2.4No patch available
- Medium4.3Cross-Site Request Forgery
Fraud Prevention For WooCommerce and EDD
≤2.1.5Update to 2.1.6
- Medium6.1Prototype Pollution to Reflected Cross-Site Scripting
Your Journey
≤1.9.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress
≤4.6.19Update to 4.6.20
- Medium5.3Missing Authorization
Slider Carousel – Image Slider
≤1.5.0Update to 1.5.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
wp tell a friend popup form
≤7.1No patch available
- Medium5.4Cross-Site Request Forgery via 'woocommerce_saphali_page_s_l'
Saphali Woocommerce Lite
≤1.8.13Update to 1.9.0
- Medium4.3Cross-Site Request Forgery
Update Theme and Plugins from Zip File
≤2.0.0No patch available
- Medium5.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.4.1Update to 4.4.2
- Critical9.8Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver
InstaWP Connect – 1-click WP Staging & Migration
≤0.0.9.18Update to 0.0.9.19