Database
WordPress Vulnerability Database (page 1104)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Privilege Escalation via Arbitrary User Meta Updates
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.6.6Update to 2.6.7
- High8.8Authenticated (Subscriber+) PHP Object Injection
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤3.0.1Update to 3.0.2
- Medium4.3Cross-Site Request Forgery
The7 — Website and eCommerce Builder for WordPress
≤11.7.3Update to 11.7.3.1
- High8.3Unauthenticated CSV Injection
Form Builder | Create Responsive Contact Forms
≤1.9.9.0No patch available
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
WPGraphQL
≤1.14.5Update to 1.14.6
- High7.6Authenticated (Subscriber+) LDAP Injection
Active Directory Integration / LDAP Integration
≤4.1.5Update to 4.1.6
- High7.5Authenticated(Author+) PHP Object Injection via unzipPosts
Zippy
≤1.6.5Update to 1.6.6
- High8.8Authenticated (Subscriber+) SQL Injection
Short URL
≤1.6.4Update to 1.6.5
- Medium4.3Missing Authorization via activate_addon
LiquidPoll – Polls, Surveys, NPS and Feedback Reviews
≤3.3.68Update to 3.3.69
- Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting
Short URL
1.6.4 – 1.6.4Update to 1.6.5
- Medium6.1Reflected Cross-Site Scripting via 'tab'
WCP OpenWeather
≤2.5.0No patch available
- High7.4Authenticated (Author+) CSV Injection
Post to CSV by BestWebSoft
≤1.4.0Update to 1.4.1
- Medium4.4Side Cart Woocommerce (Ajax) <= 2.2 Authenticated(Administrator+) Stored Cross-Site Scripting
Side Cart Woocommerce | Woocommerce Cart
≤2.2Update to 2.3
- Critical9.8Privilege Escalation
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤3.2.3Update to 3.3.0
- Critical9.8Authentication Bypass
Social Login, Social Sharing by miniOrange
≤7.6.4Update to 7.6.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Layer Slider
≤1.1.9.7No patch available
- Medium4.3Cross-Site Request Forgery
NOO Timetable
≤2.1.3No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤4.0.4Update to 4.0.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Abstracts
≤2.6.2Update to 2.6.3
- Medium4.3Cross-Site Request Forgery
WP Abstracts
≤2.6.2Update to 2.6.3
- Medium4.3Missing Authorization
SW Product Bundles
≤2.0.15No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Guest posting / Frontend Posting / Front Editor – WP Front User Submit
<3.8.5Update to 3.8.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
NOO Timetable
≤2.1.3No patch available
- High8.8Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
LearnDash LMS
≤4.6.0Update to 4.6.0.1
- Medium6.5Unauthenticated Sensitive Information Exposure
Email download link
≤3.7No patch available
- Medium4.3Cross-Site Request Forgery to Settings Reset
Waitlist Woocommerce ( Back in stock notifier )
≤2.5.2Update to 2.5.3
- Medium4.3Missing Authorization
Post Hit Counter
≤1.3.2No patch available
- Medium4.3Cross-Site Request Forgery
Quiz Expert – Easy Quiz Maker, Exam and Test Manager
≤1.5.0No patch available
- High8.8Authenticated (Subscriber+) SQL Injection
Houzez CRM
≤1.3.4Update to 1.3.5
- Medium4.3Missing Authorization
Duplicate Post Page Menu & Custom Post Type
≤2.3.1Update to 2.4.0