Database
WordPress Vulnerability Database (page 1101)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
WooCommerce Pre-Orders
≤2.0.2Update to 2.0.3
- Medium4.3Cross-Site Request Forgery
Custom Fields for WooCommerce
<1.0.4Update to 1.0.4
- Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting
Short URL
1.6.4 – 1.6.4Update to 1.6.5
- Medium6.1Reflected Cross-Site Scripting
Grid Kit Premium
<2.2.0Update to 2.2.0
- High7.1Cross-Site Request Forgery
Buy Me a Coffee – Button and Widget Plugin
≤3.7Update to 3.8
- Medium6.3Missing Authorization
WooCommerce Warranty Requests
≤2.1.9Update to 2.2.0
- Medium6.5Bypass via IP Spoofing
IP2Location Country Blocker
≤2.29.1Update to 2.29.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
Mail Control – Email Customizer, SMTP Deliverability, logging, open and click Tracking
≤0.3.1Update to 0.3.2
- Medium6.1Reflected Cross-Site Scripting
View All Post's Pages
≤0.9.0Update to 0.9.1
- Medium5.4Insecure Direct Object Reference
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<2.7.16Update to 2.7.16
- Medium4.3Cross-Site Request Forgery
Social Media Icons Widget
≤1.6No patch available
- Medium6.3Missing Authorization
WooCommerce Ship to Multiple Addresses
≤3.8.5Update to 3.8.6
- High7.3Missing Authorization
Buy Me a Coffee – Button and Widget Plugin
≤3.7Update to 3.8
- Medium4.3Cross-Site Request Forgery
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤4.0.5Update to 4.0.6
- Medium6.5Unauthenticated Insecure Direct Object Reference
WooCommerce GoCardless Gateway
≤2.5.6Update to 2.5.7
- Medium4.4Reflected Cross-Site Scripting
WooCommerce Ship to Multiple Addresses
≤3.8.5Update to 3.8.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Image Social Feed Plugin
≤1.7.6No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Video Gallery – YouTube Playlist, Channel Gallery by YotuWP
≤1.3.12Update to 1.3.13
- Medium5.3Denial of Service via Large Form Submissions
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.25Update to 3.6.26
- High7.50.0.4 - Authorization Bypass via webhook
Getnet Argentina para WooCommerce
0.0.1 – 0.0.4Update to 0.0.5
- Medium5.4Cross-Site Request Forgery
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps
≤3.4.1No patch available
- Critical9.1Client Interface <= 3.9.1 - Missing Authorization via AJAX actions
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback
<3.9.2Update to 3.9.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
oAuth Twitter Feed for Developers
≤2.3.0No patch available
- Medium4.3Cross-Site Request Forgery in new_voucher_template.php
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
≤4.3.5Update to 4.3.6
- Medium4.3Cross-Site Request Forgery
WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS
<6.2.0Update to 6.2.0
- Critical9.8Missing Authorization to Privilege Escalation
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
<2.2.1Update to 2.2.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Social Share Boost
≤4.4Update to 4.5
- Medium5.4Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.2.3.1Update to 4.2.3.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP
≤2.2.4Update to 2.2.5
- Medium6.5Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion
BadgeOS
≤3.7.1.6No patch available