Database
WordPress Vulnerability Database (page 1113)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Premium Addons Pro for Elementor
≤2.8.24Update to 2.8.25
- Medium5.4Missing Authorization via wp_insert_post_data
Extended Post Status
≤1.0.19Update to 1.0.20
- Medium4.3Cross-Site Request Forgery
SpamReferrerBlock
≤2.22No patch available
- Medium6.1Reflected Cross-Site Scripting
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.12.3Update to 1.12.4
- Medium4.3Authenticated(Contributor+) Settings Update
VK Blocks
≤1.57.0.5Update to 1.58.0.0
- Low2.7Insecure Direct Object Reference to Arbitrary Post Deletion
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
<1.11.12Update to 1.11.12
- High8.1Authentication Bypass
User Email Verification for WooCommerce
≤3.5.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CRM and Lead Management by vcita
≤2.6.2Update to 2.7.0
- Medium5.4Missing Authorization to Post Creation
Page Builder with Image Map by AZEXO
≤1.27.133No patch available
- Medium6.5Missing Authorization via review-banner-visibility REST route
Uncanny Toolkit for LearnDash
≤3.6.4.3Update to 3.6.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Event Registration Calendar By vcita
≤1.3.1Update to 1.4.0
- Medium5.4Cross-Site Request Forgery via multiple functions
JS Job Manager
≤2.0.0Update to 2.0.1
- Medium4.3Cross-Site Request Forgery via enableDisable and deletePost
PI Advanced Flat rate / Conditional shipping for WooCommerce
≤1.6.4.4Update to 1.6.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Contact Form Builder by vcita
≤4.9.1Update to 4.10.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Kanban Boards for WordPress
≤2.5.20Update to 2.5.21
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Event Registration Calendar By vcita
≤1.3.1No patch available
- Medium4.3Authenticated(Contributor+) Settings Update
VK Blocks
≤1.57.0.5Update to 1.57.0.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Page Builder with Image Map by AZEXO
≤1.27.133No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
CRM and Lead Management by vcita
≤2.7.0Update to 2.7.1
- Medium4.3Missing Authorization
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.8.16Update to 1.8.16
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Contact Form Builder by vcita
≤4.10.5Update to 4.10.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Call Now Accessibility Button
≤1.1Update to 1.2
- Medium4.3Missing Authorization via handle_installation
Social Media Share Buttons & Social Sharing Icons
≤2.8.1Update to 2.8.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
GDPR Cookie Consent Notice Box
≤1.1.6Update to 1.1.7
- Medium5.4Cross-Site Request Forgery to Account Logout
Online Booking & Scheduling Calendar by vcita
≤4.5Update to 4.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Contact Form and Calls To Action by vcita
≤2.6.4Update to 2.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WooCommerce Box Office
≤1.1.50Update to 1.1.51
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Contact Form Builder by vcita
≤4.10.3Update to 4.10.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
SpamReferrerBlock
≤2.22No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save
Page Builder with Image Map by AZEXO
≤1.27.133No patch available