Database
WordPress Vulnerability Database (page 115)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
WP Ultimate Review
≤2.4.2Update to 2.4.3
- Medium5.3Missing Authorization
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.0Update to 3.1.0
- Medium5.3Unauthenticated CAPTCHA Bypass
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.0Update to 3.1.0
- Medium5.32.0.15 - Unauthenticated Information Exposure
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
1.95 – 2.0.15Update to 2.1.0
- Medium5.3Missing Authorization
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium4.36.17.4.1 - Missing Authorization
The Events Calendar
6.15.0 – 6.17.4.1Update to 6.17.5
- Medium5.3Unauthenticated Poll Vote Limit Bypass
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium5.310.8.1 - Unauthenticated Arbitrary User Meta Corruption
WP Recipe Maker
9.8.0 – 10.8.1Update to 10.8.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.9.4Update to 8.9.5
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.9.4Update to 8.9.5
- Medium4.38.9.4 - Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.9.1 – 8.9.4Update to 8.9.5
- Medium5.38.9.4 - Unauthenticated Information Exposure
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.1 – 8.9.4Update to 8.9.5
- High8.8Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation
WP OAuth Server ( Login with WordPress )
≤6.3.0Update to 6.4.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payment Plugins for PayPal WooCommerce
≤2.0.26Update to 2.0.27
- Medium5.3Unauthenticated Payment Manipulation
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More
≤2.3.3Update to 2.3.4
- Critical9.8Unauthenticated Remote Code Execution
YAHMAN Add-ons
≤0.9.30Update to 0.9.31
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.69Update to 3.1.70
- Medium5.37.5.1 - Unauthenticated Information Exposure
Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster
7.0.0 – 7.5.1Update to 7.5.2
- Medium5.3Unauthenticated Information Exposure
Post Grid Gutenberg Blocks – PostX
≤5.0.40Update to 5.0.41
- Medium4.310.8.1 - Authenticated (Subscriber+) Information Exposure
WP Recipe Maker
10.3.0 – 10.8.1Update to 10.8.2
- Medium6.3Authenticated (Subscriber+) HTML Injection
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Missing Authorization
Zportals
≤6.4.1Update to 6.4.2
- Medium5.3Unauthenticated Forged Payment and Subscription Events
Premium Packages – Sell Digital Products Securely
≤7.2.0Update to 7.2.1
- Medium4.3Missing Authorization
WC Fields Factory
≤4.1.10Update to 4.1.11
- Medium6.41.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form
1.4.1 – 1.6.2Update to 1.6.3
- Medium6.5Authenticated (Author+) SQL Injection
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.20Update to 2.1.21
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium4.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Translate WordPress with GTranslate
≤5.0.0Update to 5.0.1
- Medium5.3Unauthenticated Information Exposure
Easy Hide Login
≤1.6Update to 1.7