Database
WordPress Vulnerability Database (page 1177)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization to Unauthenticated Content Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.1.9.2Update to 5.1.9.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
WPMobile.App – Android and iOS App Builder
≤11.13Update to 11.14
- High7.2Authenticated (Subscriber+) SQL Injection
RapidLoad AI – Optimize Web Vitals Automatically
≤1.6.35Update to 1.6.36
- Medium4.3Cross-Site Request Forgery
Responsive Vertical Icon Menu
≤1.5.8Update to 1.5.9
- Medium5.3Improper Authorization to Price Change
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.1.9.2Update to 5.1.9.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WPBot – ChatBot Conversational Forms
≤1.1.6Update to 1.1.7
- Medium4.3Cross-Site Request Forgery
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
≤2.0.8Update to 2.0.9
- Medium5.5Authenticated (Admin+) Cross Site Scripting
VikRentCar Car Rental Management System
≤1.3.0Update to 1.3.1
- Critical9.8Unauthenticated Local File Inclusion
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.7.3.2Update to 4.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Social Comments by Heateor
≤1.6.1Update to 1.6.2
- High8.3Missing Authorization
Reviews and Rating – Google Reviews
4.14 – 4.14Update to 4.15
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
CTT Expresso para WooCommerce
≤3.2.11Update to 3.2.12
- Medium5.3Content Spoofing
Quiz Maker by AYS
≤6.3.9.4Update to 6.3.9.5
- Medium4.9Authenticated (Admin+) Directory Traversal
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤9.0.15Update to 9.0.16
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WPFrom Email
≤1.8.8Update to 1.8.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple Staff List
≤2.2.2Update to 2.2.3
- Medium4.3Missing Authorization to Sensitive Information Exposure
WP Client Reports
≤1.0.16Update to 1.0.17
- Medium5.5Authenticated (Administrator+) Stored Cross Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤2.3.0Update to 2.3.1
- Medium5.3Authorization Bypass
My Tickets – Accessible Event Ticketing
≤1.9.11Update to 1.9.12
- Medium6.3Missing Authorization Checks
Quick Event Manager
≤9.7.4Update to 9.7.5
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting
WP Flipclock
≤1.7.4Update to 1.8
- Medium4.1Improper Authorization Checks
WP Time Slots Booking Form
≤1.1.82Update to 1.1.83
- Medium6.6Authenticated (Admin+) SQL Injection
Booking Calendar
≤9.4.2Update to 9.4.3.1
- Medium4.3Cross-Site Request Forgery
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤3.8.5Update to 3.8.6
- Medium4.3Cross-Site Request Forgery
WP Fast Cache
≤1.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Easy PayPal & Stripe Buy Now Button
≤1.7.3Update to 1.7.4
- Medium5.4Missing Authorization
URL Shortener by MyThemeShop
≤1.0.16No patch available
- High8.8Authenticated (Contributor+) SQL Injection
WP Helper Premium
≤4.2.0Update to 4.3.0
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
M Chart
≤1.9.4Update to 1.10
- High8.8Cross Site Request Forgery
Maintenance Mode by Supsystic
≤1.7.10Update to 1.7.11