Database
WordPress Vulnerability Database (page 110)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
Spectra Legacy – Gutenberg Blocks
≤2.20.0Update to 2.20.1
- Medium5.4Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
WP Multilang – Translation and Multilingual Plugin
≤2.4.31Update to 2.4.32
- Critical9.8Unauthenticated Local File Inclusion via 'vcv-template' Parameter
Visual Composer Website Builder
≤45.16.0Update to 45.16.1
- High8.8Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
YOP Poll
≤7.0.10Update to 7.0.11
- High7.5Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
eesy_ID2WP – Publish InDesign HTML5
≤1.0.3Update to 1.0.4
- Medium4.9Authenticated (Editor+) SQL Injection
W4 Post List
≤3.0.6Update to 3.0.7
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP
≤2.1.7Update to 2.1.8
- Medium5.3Unauthenticated Insecure Direct Object Reference
Team – Team Members Showcase Plugin
≤6.0.0Update to 6.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.69Update to 3.1.70
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetTricks
≤2.0.1Update to 2.0.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Medium4.3Cross-Site Request Forgery
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
≤2.50.1Update to 2.51.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.5Update to 7.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.105Update to 4.11.106
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.5Update to 4.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Podcast Importer SecondLine
≤1.5.6Update to 1.5.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate FAQ Accordion Plugin
≤2.4.14Update to 2.5.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Core Web Vitals & PageSpeed Booster
≤1.0.31Update to 1.0.32
- Medium5.3Missing Authorization
PayPlus Payment Gateway
≤8.2.5Update to 8.2.6
- Critical9.8Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter
Paytium: Mollie payment forms & donations
≤5.0.3Update to 5.0.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Tainacan
≤1.2.0Update to 1.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Razorpay Payment Button Plugin
≤2.4.9Update to 2.5.0
- Medium5.3Missing Authorization
Online Booking & Scheduling Calendar by vcita
≤4.6.0Update to 4.6.3
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Reycob Product Import Export
≤2.3.0Update to 2.4.0
- Medium5.3Missing Authorization
Tangible: Loops & Logic
≤4.2.4Update to 4.3.0
- Medium5.3Missing Authorization
Conekta Payment Gateway
≤6.2.4Update to 6.2.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Mang Board
≤2.4.1Update to 2.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Photo Album Plus
≤9.3.02.002Update to 9.3.02.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
wpForo Forum
≤3.1.5Update to 3.1.6