Database
WordPress Vulnerability Database (page 112)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Safe SVG
≤2.5.0Update to 2.5.1
- Medium5.3Unauthenticated Login Captcha Protection Bypass
Captcha Code
≤3.32Update to 3.33
- High7.2Unauthenticated Server-Side Request Forgery
Link Library
≤7.9.5Update to 7.9.6
- Medium4.3Authenticated (Contributor+) Path Traversal
Link Library
≤7.9.5Update to 7.9.6
- Medium5.3Missing Authorization
Netgsm
≤2.10.0Update to 2.10.2
- Medium4.9Authenticated (Administrator+) SQL Injection
Simple Discount Rules for Woocommerce
≤5.18Update to 5.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Safe SVG
≤2.5.0Update to 2.5.1
- Medium6.1Reflected Cross-Site Scripting
Link Library
≤7.9.5Update to 7.9.6
- Medium5.3Unauthenticated Information Exposure
Team Members
≤9.2Update to 9.3
- Medium6.5Authenticated (Author+) SQL Injection
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.9Update to 1.17.10
- Medium4.9Authenticated (Administrator+) SQL Injection
Estatik Real Estate Plugin
≤4.3.5Update to 4.3.6
- Medium5.3Unauthenticated Unauthorized User Registration
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- High7.5Unauthenticated SQL Injection
Bluff Post
≤1.1.1No patch available
- High7.5Unauthenticated SQL Injection via 'log' (Username) Parameter
Rename wp-login.php to anything you want
≤2.0.1No patch available
- Medium6.5Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode
Advanced Contact form 7 DB
≤2.1.1Update to 2.1.2
- Medium5.3Unauthenticated Information Exposure
TrustedLogin Connector
≤2.0.3Update to 2.0.4
- Medium5.32.0.1.1 - Missing Authorization
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.8.8.2 – 2.0.1.1Update to 2.0.2
- Medium5.3Missing Authorization
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.33.0Update to 2.34.0
- High8.1KEVPoCUnauthenticated Local File Inclusion via locate_template() Path Traversal
WordPress
≤7.1.1Update to 4.7.37 or 4.8.32 or 4.9.33 or 5.0.29 or 5.1.26 or 5.2.28 or 5.3.25 or 5.4.23 or 5.5.22 or 5.6.21 or 5.7.19 or 5.8.17 or 5.9.18 or 6.0.16 or 6.1.14 or 6.2.13 or 6.3.12 or 6.4.12 or 6.5.12 or 6.6.9 or 6.7.9 or 6.8.10 or 6.9.9 or 7.0.6 or 7.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultra Addons for Contact Form 7
≤3.5.50Update to 3.5.51
- Medium4.37.4.4 - Authenticated (Subscriber+) Information Exposure
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
7.4.1 – 7.4.4Update to 7.4.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.4Update to 7.4.5
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.71Update to 2.1.72
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher
≤2.8.25Update to 2.8.26
- Medium5.3Missing Authorization to Account Registration
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Unauthenticated (Subscriber+) Unauthorized Course Enrollment
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Authenticated (Subscriber+) Information Exposure
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.1Update to 3.4.2
- High7.5Authenticated (Subscriber+) PHP Object Injection
wpForo Forum
≤3.1.5Update to 3.1.6