Database
WordPress Vulnerability Database (page 1144)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated SQL Injection
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
≤4.3.2Update to 4.3.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Ultimate Review
≤2.0.3Update to 2.1.0
- Medium6.1Reflected Cross-Site Scripting
Easy Forms for Mailchimp
≤6.8.7Update to 6.8.8
- Medium4.3Cross-Site Request Forgery via process_bulk_action()
Affiliates Manager
≤2.9.20Update to 2.9.21
- Medium6.3Missing Authorization
HappyFiles Pro
≤1.8.1Update to 1.8.2
- Medium5.4Missing Authorization on openai_settings_option_callback
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.4.7Update to 4.4.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Social Proof (Testimonial) Slider
≤2.2.3Update to 2.2.4
- Medium4.3Cross-Site Request Forgery leading to Plugin Settings Changes
Mobile Banner
≤1.5Update to 1.6
- High8.1Authenticated (Author+) Arbitrary File Deletion
Easy Media Replace
≤0.1.3Update to 0.2.0
- Medium4.3Cross-Site Request Forgery via paginate_shipping_provider_list and filter_shipping_provider_list
Advanced Shipment Tracking for WooCommerce
≤3.5.2Update to 3.5.3
- Medium5.4Cross-Site Request Forgery
LionScripts: IP Blocker Lite
≤11.1.1No patch available
- High8.8Authenticated(Subscriber+) SQL Injection
WC Fields Factory
≤4.1.5Update to 4.1.6
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Custom Post Type and Taxonomy GUI Manager
≤1.1No patch available
- High8.8Authenticated(Subscriber+) Privilege Escalation via update_page_option
Elementor Website Builder Pro
≤3.11.6Update to 3.11.7
- Medium4.3Cross-Site Request Forgery via dismiss_notice
Maps Widget for Google Maps
≤4.23Update to 4.24
- Medium6.1Reflected Cross-Site Scripting via search_term
Full Width Slider – Responsive Hero, Banner & Image Slider
≤1.1.7Update to 1.1.8
- Medium4.3Cross Site Request Forgery
Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions
<2.2.2Update to 2.2.2
- Medium6.5Sensitive Data Exposure
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
≤3.1.3Update to 3.1.4
- Medium5.4Cross-Site Request Forgery to Sensitive Information Exposure
Custom Post Type UI
≤1.13.4Update to 1.13.5
- Medium4.3Cross-Site Request Forgery via save_user_profile
Simple Author Box
≤2.50Update to 2.51
- Medium6.5Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Image Carousel
≤1.0.2No patch available
- Medium4.3Missing Authorization
Advanced Local Pickup for WooCommerce – Click & Collect, In-Store Pickup
≤1.5.2Update to 1.5.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Video Central for WordPress
≤1.3.0No patch available
- Medium6.1Reflected Cross-Site Scripting via Arbitrary Query String Parameter
Product Specifications for Woocommerce
≤0.6.0Update to 0.7.0
- Medium6.1Reflected Cross-Site Scripting via 'tab'
Woocommerce Custom Checkout Fields Editor With Drag & Drop
≤0.1No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
MS-Reviews
≤1.5No patch available
- High7.2Authenticated (Administrator+) SQL Injection
WC Fields Factory
≤4.1.5Update to 4.1.6
- Medium6.1Reflected Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤21.1.2Update to 21.1.2.1
- Critical9.8Unauthenticated SQL Injection
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤3.4.11Update to 4.0
- High8.8Authenticated (Author+) PHAR Deserialization
WP Meta SEO
≤4.5.4Update to 4.5.5