Database
WordPress Vulnerability Database (page 1105)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Abstracts
≤2.6.2Update to 2.6.3
- Medium4.3Cross-Site Request Forgery
WP Abstracts
≤2.6.2Update to 2.6.3
- Medium4.3Cross-Site Request Forgery
NOO Timetable
≤2.1.3No patch available
- Medium4.3Cross-Site Request Forgery to Settings Reset
Waitlist Woocommerce ( Back in stock notifier )
≤2.5.2Update to 2.5.3
- High8.8Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
LearnDash LMS
≤4.6.0Update to 4.6.0.1
- Medium4.4Chaty <= 3.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
≤3.1.1Update to 3.1.2
- Medium4.3Cross-Site Request Forgery
AutomateWoo
≤5.7.5Update to 5.7.6
- Medium6.1Reflected Cross-Site Scripting
WooCommerce Pre-Orders
≤2.0.1Update to 2.0.2
- Medium4.8Ultimate Form Builder <= 8.4.3 - Authenticated Stored Cross-Site Scripting via Form Name
NEX-Forms – Ultimate Forms Plugin for WordPress
≤8.4.3Update to 8.4.4
- Medium6.5Cross-Site Request Forgery to Account Compromise
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤2.5.6Update to 2.5.7
- Medium4.3Cross-Site Request Forgery
Subscribe2 – Form, Email Subscribers & Newsletters
≤10.40Update to 10.41
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
ApplyOnline – Application Form Builder and Manager
≤2.5.5Update to 2.5.6
- High8.8Authenticated (Subscriber+) SQL Injection via 'id'
GradeBook
≤5.0.1No patch available
- Medium4.3Cross-Site Request Forgery to Settings Reset
Login & Register Customizer – Forms, Popup, Profile & WooCommerce
<2.4Update to 2.4
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Autochat Automatic Conversation
≤1.1.9No patch available
- Medium4.3Cross-Site Request Forgery
WooCommerce Ship to Multiple Addresses
≤3.8.5Update to 3.8.6
- Medium4.3Cross-Site Request Forgery
Caldera Forms Google Sheets Connector
≤1.3No patch available
- Medium4.3Cross-Site Request Forgery to Arbitrary Log Deletion
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤2.5.6Update to 2.5.7
- Medium4.3Missing Authorization
Subscribe2 – Form, Email Subscribers & Newsletters
≤10.40Update to 10.41
- Medium6.5Missing Authorization
AutomateWoo
≤5.7.5Update to 5.7.6
- Medium5.3Sensitive Information Exposure
EmbedPress
≤3.7.3Update to 3.8.0
- Medium4.3Cross-Site Request Forgery
GSheetConnector – WooCommerce Google Sheets Connector, Export Orders & Products to Google Sheets in Real-Time
≤1.3.5Update to 1.3.6
- Medium6.4Missing Authorization to Stored Cross-Site Scripting
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
≤1.0.0No patch available
- Medium4.7Authenticated (Admin+) Server-Side Request Forgery
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
≤4.6.2Update to 4.6.3
- Medium6.1Reflected Cross-Site Scripting
Login Configurator
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery
Woocommerce Order Barcodes
≤1.6.4Update to 1.6.5
- Medium6.1Reflected Cross-Site Scripting
Balkon
≤1.3.2Update to 1.3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MaxButtons – Create buttons
≤9.5.3Update to 9.6
- Medium6.1Reflected Cross-Site Scripting
Membership Plugin – Kadence Memberships
<3.2.3Update to 3.2.3