Database
WordPress Vulnerability Database (page 1112)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via 'filterType'
KiviCare – Clinic & Patient Management System (EHR)
<3.2.1Update to 3.2.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
CodeColorer
≤0.10.0Update to 0.10.1
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via edcal_saveoptions AJAX action
Editorial Calendar
≤3.8.0Update to 3.8.1
- Medium4.3Cross-Site Request Forgery via delete_item
WP Inventory Manager
≤2.1.0.13Update to 2.1.0.14
- Medium5.4Cross-Site Request Forgery via verify_code_integation_new
GSheetConnector – Gravity Forms Google Sheets Connector – Real-Time Sync
≤1.3.4Update to 1.3.5
- Medium6.1Reflected Cross-Site Scripting
WP Brutal AI
<2.0.1Update to 2.0.1
- Medium4.3Missing Authorization to Information Disclosure
Visitor Traffic Real Time Statistics
<6.8Update to 6.9
- High7.2Authenticated (Administrator+) SQL Injection via 'type'
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
<1.12.4Update to 1.12.4
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Aajoda Testimonials
≤2.2.1Update to 2.2.2
- Medium6.1Reflected Cross-Site Scripting via error_msg
WordPress Tables
≤1.3.9No patch available
- Medium6.1Reflected Cross-Site Scripting
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
<1.12.4Update to 1.12.4
- Medium5.4Missing Authorization
KiviCare – Clinic & Patient Management System (EHR)
≤3.2.0Update to 3.2.1
- High8.8Cross-Site Request Forgery to SQL Injection
WP Brutal AI
<2.0.0Update to 2.0.0
- Medium6.6Authenticated(Administrator+) SQL Injection
FormCraft – Form Builder
≤3.9.5Update to 3.9.6
- High8.8Authenticated (Subscriber+) Authentication Bypass via Cookie
WP User Switch
≤1.0.2Update to 1.0.3
- Medium4.3Missing Authorization to Authenticated(Subscriber+) Information Disclosure
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
≤4.6.00Update to 4.6.20
- Medium5.4Missing Authorization via rexvs_settings_submit
Change WooCommerce Add To Cart Button Text
≤1.3No patch available
- Medium4.3Cross-Site Request Forgery via kebo_twitter_menu_render
Kebo Twitter Feed
≤1.5.12No patch available
- Medium5.4Missing Authorization to Authenticated(Subscriber+) Post Visibility Modification
Dynamic Visibility for Elementor
<5.0.6Update to 5.0.6
- High7.1Missing Authorization via setToken
Cart2Cart: Magento to WooCommerce Migration
≤2.0.0No patch available
- Medium4.3Cross-Site Request Forgery via wishlist_add and wishlist_remove
WPC Smart Wishlist for WooCommerce
≤4.7.1Update to 4.7.2
- Medium4.3Cross-Site Request Forgery via save_bulk_edit_data
WP Hide Post
≤2.0.10No patch available
- Medium6.5Missing Authorization to Authenticated(Subscriber+) Price Modification
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
≤4.6.00Update to 4.6.20
- Medium4.3Missing Authorization via constant_contact_optin_ajax_handler
Constant Contact Forms
≤1.14.0Update to 2.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Online Booking & Scheduling Calendar by vcita
≤4.3.0Update to 4.3.1
- Medium5.4Missing Authorization via wp_insert_post_data
Extended Post Status
≤1.0.19Update to 1.0.20
- Medium4.3Cross-Site Request Forgery via delete_item
WP Inventory Manager
≤2.1.0.13Update to 2.1.0.14
- Medium4.3Authenticated(Contributor+) Settings Update
VK Blocks
≤1.57.0.5Update to 1.58.0.0
- Medium6.1Reflected Cross-Site Scripting
Premium Addons Pro for Elementor
≤2.8.24Update to 2.8.25
- Medium5.3Missing Authorization
WooCommerce Box Office
≤1.1.51Update to 1.1.52