Database
WordPress Vulnerability Database (page 111)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.1Update to 5.5.1.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Event Tickets and Registration
≤5.29.4Update to 5.29.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPS Limit Login
≤1.5.9.3Update to 1.5.9.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
PixelYourSite – Your smart PIXEL (TAG) & API Manager
≤11.4.1Update to 11.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium5.3Missing Authorization
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)
≤3.15.4Update to 3.15.5
- Medium4.9Authenticated (Administrator+) SQL Injection
Email Log
≤2.63Update to 2.64
- Medium4.9Authenticated (Editor+) SQL Injection
Ultimeter – the Ultimate Progress and Goals Meter
≤3.0.8Update to 3.1.0
- Medium6.5Authenticated (Contributor+) SQL Injection
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.4Update to 6.0.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Mollie Forms
≤2.11.0Update to 2.11.1
- Medium6.5Authenticated (Contributor+) SQL Injection
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator
≤1.5.10Update to 1.5.11
- Medium4.3Missing Authorization
Fluent Support – Helpdesk & Customer Support Ticket System
≤2.3.2Update to 2.4.0
- Medium4.9Authenticated (Shop Manager+) SQL Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.0Update to 3.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Blocks – Gutenberg Blocks, Patterns & Templates
≤2.3.17Update to 2.3.18
- High8.8Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
Import and export users and customers
≤2.4.17Update to 2.4.18
- Medium5.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.70Update to 2.1.72
- High8.1Unauthenticated Authentication Bypass
EthPress – Web3 Login
≤2.3.5Update to 2.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.5Update to 7.9.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
YITH Request a Quote for WooCommerce (Premium)
<4.46.1Update to 4.46.1
- High7.5Unauthenticated SQL Injection
Product Filter for WooCommerce by WBW
≤3.1.7Update to 3.1.8
- Medium4.3Missing Authorization to Authenticated (Contributor+) Unauthorized Post and Media Modification
WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
≤2.7.0Update to 2.7.1
- Medium5.3Unauthenticated Unauthorized User Registration
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium6.3Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium4.9Authenticated (Administrator+) SQL Injection
Admin Notices Manager
≤1.6.0Update to 1.6.1
- Medium4.9Authenticated (Administrator+) SQL Injection
Estatik Real Estate Plugin
≤4.3.5Update to 4.3.6
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Safe SVG
≤2.5.0Update to 2.5.1
- Medium5.3Unauthenticated Login Captcha Protection Bypass
Captcha Code
≤3.32Update to 3.33
- High7.2Unauthenticated Server-Side Request Forgery
Link Library
≤7.9.5Update to 7.9.6
- Medium4.3Authenticated (Contributor+) Path Traversal
Link Library
≤7.9.5Update to 7.9.6