Database
WordPress Vulnerability Database (page 1118)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Go Pricing - WordPress Responsive Pricing Tables
≤3.3.19Update to 3.4
- Medium4.3Cross-Site Request Forgery in ytpp_settings
Playlist Player for YouTube – Fast, Privacy-Friendly Playlists & Channel Feed
≤4.6.4Update to 4.6.5
- High7.1WordPress Responsive Pricing Tables <= 3.3.19 - Improper Authorization to Arbitrary File Upload
Go Pricing - WordPress Responsive Pricing Tables
≤3.3.19Update to 3.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Iptanus File Upload
≤4.19.1Update to 4.19.2
- Medium5.3CAPTCHA Bypass
WS Form LITE – Drag & Drop Contact Form Builder
≤1.9.117Update to 1.9.118
- High7.2Authenticated (Administrator+) SQL Injection in projects_list and total_projects
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤3.3.19Update to 3.3.20
- High7.2Authenticated (Administrator+) SQL Injection via 'orderby'
SIS Handball
≤1.0.45No patch available
- Medium4.9Authenticated (Administrator+) Path Traversal
Iptanus File Upload
≤4.19.1Update to 4.19.2
- Medium4.6WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting
Go Pricing - WordPress Responsive Pricing Tables
≤3.3.19Update to 3.4
- Medium5.5Stored Cross-Site Scripting
WooCommerce Tax (formerly WooCommerce Shipping & Tax)
<2.2.5Update to 2.2.5
- Critical9.8Authentication Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.1Update to 3.9.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
≤4.0.9.1Update to 4.0.9.2
- Medium6.1Reflected Cross-Site Scripting
WP-Hijri
≤1.5.1Update to 1.5.2
- Critical9.9Arbitrary File Upload in File Manager
Unlimited Elements for Elementor
≤1.5.60Update to 1.5.61
- Medium6.1Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter
Bubble Menu – Floating Button Menu with Sticky Navigation
≤3.0.3Update to 3.0.4
- Medium6.1Reflected Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
≤3.1.11Update to 3.1.12
- High7.5Missing Authorization via easy_captcha_update_settings
Easy Captcha
≤1.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Book Information Fields
Novelist
≤1.2.0Update to 1.2.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Display Name
Connect Matomo – Analytics Dashboard for WordPress
≤1.0.27Update to 1.0.28
- High7.2Authenticated (Admin+) SQL Injection
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
≤3.1.6Update to 3.1.7
- Medium5.4Elementor <= 3.13.2 Authenticated(Contributor+) Arbitrary Post Type Creation via save_item
Elementor Website Builder – more than just a page builder
<3.13.3Update to 3.13.3
- High8.8Authenticated (Contributor+) SQL Injection
LearnDash LMS
≤4.5.3Update to 4.5.3.1
- High7.2Authenticated (Administrator+) Arbitrary File Upload
Slider Revolution
≤6.6.12Update to 6.6.13
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via vx-entries shortcode
Database for Contact Form 7, WPforms, Elementor forms
≤1.3.0Update to 1.3.1
- Medium5.3Sensitive Information Exposure
EventPrime – Events Calendar, Bookings, Tickets & AI
≤2.8.6Update to 3.0.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Custom Post Type Generator
≤2.4.2No patch available
- Medium6.1Reflected Cross-Site Scripting
EventPrime – Events Calendar, Bookings, Tickets & AI
≤2.8.6Update to 3.0.0
- Medium4.3Cross-Site Request Forgery
Woocommerce Follow-ups
≤4.9.40Update to 4.9.50
- Medium6.1Reflected Cross-Site Scripting
Woocommerce Follow-ups
≤4.9.40Update to 4.9.50
- High7.1Reflected Cross-Site Scripting
WooCommerce Warranty Requests
≤2.1.6Update to 2.1.7