Database
WordPress Vulnerability Database (page 1107)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MonsterInsights Pro
≤8.14.1Update to 8.15
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Complianz GDPR/CCPA Cookie Consent Banner
≤6.4.4Update to 6.4.5
- Medium6.1Reflected Cross-Site Scripting
Gravity Forms
≤2.7.4Update to 2.7.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
Mailtree Log Mail
≤1.0.0Update to 1.0.1
- Medium6.3Missing Authorization
Elementor Website Builder Pro
≤3.13.0Update to 3.13.1
- Medium4.3Cross-Site Request Forgery
WooCommerce PayPal Payments
<2.0.5Update to 2.0.5
- Medium6.3Missing Authorization
Unlimited Elements for Elementor
≤1.5.65Update to 1.5.66
- Medium6.3Authenticated (Subscriber+) Insecure Direct Object Reference
JS Help Desk – AI-Powered Support & Ticketing System
≤2.7.7Update to 2.7.8
- Medium4.3Cross-Site Request Forgery
Complianz GDPR/CCPA Cookie Consent Banner
≤6.4.5Update to 6.4.6
- Medium4.3Cross-Site Request Forgery in hm_wcdon_admin_page
Potent Donations for WooCommerce
≤1.1.9Update to 1.1.10
- Medium6.1Reflected Cross-Site Scripting
WPForms Pro
≤1.8.1.2Update to 1.8.1.3
- Critical9.8Authentication Bypass
Bookit — Booking & Appointment Calendar
≤2.3.7Update to 2.3.8
- Medium6.6Authenticated (Shop manager+) SQL Injection via currency parameters
WooPayments: Integrated WooCommerce Payments
≤5.9.0Update to 5.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPBakery Page Builder
≤6.12.0Update to 6.13.0
- Medium6.4Authenticated(Administrator+) CSV Injection
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤2.2.5Update to 2.2.6
- Critical9.8Unauthenticated SQL Injection
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.7Update to 3.9.8
- Medium4.7Open Redirect via _wp_http_referer
Core Web Vitals & PageSpeed Booster
≤1.0.12Update to 1.0.13
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Float menu – awesome floating side menu
≤5.0.2Update to 5.0.3
- Medium6.6Authenticated(Administrator+) Remote Code Execution
HTTP Headers
≤1.18.10Update to 1.18.11
- Medium5.3Missing Authorization via cyrtrans_ajax_old AJAX action
Greeklish-permalink
≤3.3Update to 3.5
- Medium6.6Authenticated(Administrator+) SQL Injection
All In One Redirection
≤2.1.0Update to 2.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Social Share, Social Login and Social Comments Plugin – Super Socializer
≤7.13.52Update to 7.13.53
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
MojoPlug Slide Panel
≤1.1.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Call Now Accessibility Button
≤1.0.2Update to 1.1
- Medium6.1Reflected Cross-Site Scripting
Companion Sitemap Generator – Simple, Smart, and SEO-Ready
≤4.5.1.1Update to 4.5.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Smoothscroller
≤1.0.0Update to 1.1.0
- Medium5.3Missing Authorization via 'data/update' API Endpoint
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤1.8.5Update to 1.8.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG
Enable SVG Uploads
≤2.1.5No patch available
- Medium4.3Cross-Site Request Forgery
WooCommerce Brands
≤1.6.49Update to 1.6.50
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Extra User Details
≤0.5Update to 0.5.1