Database
WordPress Vulnerability Database (page 1110)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to PDF Settings Update
WP PDF Generator
≤1.2.2Update to 1.2.3
- Medium4.3Cross-Site Request Forgery to Order Status Update
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.6Update to 3.9.7
- Medium6.1Reflected Cross-Site Scripting
Church Admin
≤3.7.29Update to 3.7.30
- Medium4.3Cross-Site Request Forgery to Firebase Server Key Update
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.6Update to 3.9.7
- Medium4.3Cross-Site Request Forgery to Order Title Update
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.6Update to 3.9.7
- High7.5Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure
WooCommerce Stripe Payment Gateway
≤7.4.0Update to 5.5.1 or 5.6.3 or 5.7.1 or 5.8.2 or 5.9.1 or 6.0.1 or 6.1.1 or 6.2.1 or 6.3.1 or 6.4.4 or 6.5.2 or 6.6.1 or 6.7.1 or 6.8.1 or 6.9.1 or 7.0.3 or 7.1.1 or 7.2.1 or 7.3.1 or 7.4.1
- Medium6.3Missing Authorization
WooCommerce Stripe Payment Gateway
≤7.4.0Update to 7.4.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤1.2.1Update to 1.2.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤4.0.2Update to 4.0.3
- Medium4.3Cross-Site Request Forgery
Securimage-WP
≤3.6.16No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Login Configurator
≤2.1No patch available
- Medium6.5Cross-Site Request Forgery to Plugin Settings Reset
All Bootstrap Blocks
≤1.3.6Update to 1.3.7
- High7.2Reflected Cross-Site Scripting
GSheetConnector – Ninja Forms Google Sheets Connector, Export Form Submissions Instant Sync to Sheets
≤1.2.6Update to 1.2.7
- Medium6.1Reflected Cross-Site Scripting
GSheetConnector – WPForms Google Sheets Connector, Save WPForms Lite & PRO Entries to Database & Sheets
≤3.4.5Update to 3.4.6
- Medium5.3Unauthenticated Information Disclosure to Protection Bypass
Protect WP Admin
≤3.8Update to 4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
ND Shortcodes
≤6.9Update to 7.0
- Medium6.5Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action
WP Directory Kit
≤1.2.3Update to 1.2.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Email
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
≤2.4.5Update to 2.4.6
- Medium6.1Reflected Cross-Site Scripting via 'code'
Elementor Forms Google Sheet Connector Pro
≤1.0.6No patch available
- Medium4.3Cross-Site Request Forgery via _accua_forms_form_edit_action
Contact Forms by Cimatti
≤1.5.7Update to 1.5.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Guest posting / Frontend Posting / Front Editor – WP Front User Submit
<3.8.0Update to 3.8.0
- Medium5.3Race Condition to Multiple Poll Voting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.23.3Update to 1.24.1
- Medium6.4Authenticated (Subscriber+) Local File Inclusion
ND Shortcodes
≤6.9Update to 7.0
- Medium6.5Missing Authorization
MStore API – Create Native Android & iOS Apps On The Cloud
<3.9.7Update to 3.9.7
- High7.5Missing Authorization via REST API
Tutor LMS – eLearning and online course solution
≤2.2.0Update to 2.2.1
- Medium6.1Reflected Cross-Site Scripting via 'code'
CF7 Google Sheets Connector Pro
<2.3.7Update to 2.3.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
Mail logging & Catcher
≤2.1.2Update to 2.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Email
GD Mail Queue
≤3.9.3Update to 4.0
- Medium6.5Authenticated (Subscriber+) Information Disclosure via mf shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤3.3.1Update to 3.3.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤3.3.0Update to 3.3.1