Database
WordPress Vulnerability Database (page 116)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification
≤2.10.3Update to 2.10.4
- Medium4.35.7.2 - Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
5.3.6 – 5.7.2Update to 5.7.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.20Update to 2.1.21
- Medium5.3Unauthenticated Payment Bypass
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Meta Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤5.2.16Update to 5.2.17
- Medium4.3Authenticated (Subscriber+) Information Exposure
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium5.3Missing Authorization
Social Commerce for WooCommerce
≤2.5.4No patch available
- Medium5.31.2.5 - Unauthenticated Information Exposure
Lightbox
1.2.2 – 1.2.5No patch available
- Medium5.3Missing Authorization
E-cab Taxi Booking Manager for Woocommerce
<2.0.8Update to 2.0.8
- Critical9.8Unauthenticated Arbitrary File Upload
Web to Print Online Designer
≤2.14.0Update to 2.15.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Partial Shipment for WooCommerce
≤3.4Update to 3.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
Gum Addon for Elementor
≤1.3.15Update to 1.3.16
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action
Empik for Woocommerce
≤1.5.1Update to 1.5.2
- Medium5.3Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
WordLift – AI powered SEO – Schema
≤3.54.10Update to 3.54.14
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
Redux Framework
≤4.5.13Update to 4.5.14
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
Datalogics Ecommerce Delivery – Datalogics
≤2.6.65Update to 2.6.66
- Medium5.3Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
TikTok
≤1.4.1Update to 1.4.2
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
YS LeadGen – Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation
≤2.1.4Update to 2.1.5
- Medium4.7Reflected Cross-Site Scripting via ESI 'esi' Parameter
LiteSpeed Cache
≤7.9Update to 7.9.1
- High7.5Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
YS LeadGen – Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation
≤2.1.4Update to 2.1.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 's' Parameter
WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals
≤2.5.0Update to 2.6.0
- Medium6.1Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
WP Customer Reviews
≤3.7.8Update to 3.8.0
- Medium6.5Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting
Wow Elements Addons for Elementor
≤1.11.2Update to 1.11.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤2.0.11Update to 2.0.12
- High8.8Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
The Welcomizer
≤2.8.1Update to 999.0
- Medium6.1Reflected Cross-Site Scripting via 'uri' and 'host' Parameters
SSL Zen — SSL Certificate Installer & HTTPS Redirects
≤4.7.42Update to 4.7.43
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.1.1Update to 5.1.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
≤5.7.1Update to 5.7.2