Database
WordPress Vulnerability Database (page 118)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action
Divi Essentials
≤5.8.1Update to 5.9.0
- Medium5.3Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.33Update to 3.0.0
- Medium6.5Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.33Update to 3.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
WPComplete
≤2.9.9.0Update to 2.9.9.1
- Medium5.31.4.1 - Missing Authorization
TikTok
1.2.0 – 1.4.1Update to 1.4.2
- Medium4.3Authenticated (Author+) Information Exposure
Meow Gallery
≤5.5.4Update to 5.5.5
- Medium5.3Unauthenticated Arbitrary Shortcode Execution
Meow Gallery
≤5.5.4Update to 5.5.5
- Medium4.3Cross-Site Request Forgery
Sign-up Sheets
≤2.3.0Update to 2.4.0
- High7.5Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
WP Photo Album Plus
≤9.2.09.002Update to 9.3.01.003
- Medium5.3Missing Authorization
Tripzzy – Travel Engine System
≤1.5.0Update to 1.5.1
- Medium5.3Missing Authorization
Tripzzy – Travel Engine System
≤1.5.0Update to 1.5.1
- High7.2Authenticated (Admin+) Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium5.3Unauthenticated Content Injection
To Do List Member
≤1.6No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
Unlimited Elements for Elementor
≤2.0.19Update to 2.0.20
- Medium4.3Authenticated (Admin+) Insecure Direct Object Reference
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Low2.7Authenticated (Admin+) Insecure Direct Object Reference
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Master Slider – Responsive Touch Slider
<3.11.5Update to 3.11.5
- High7.2Authenticated (Admin+) Privilege Escalation
Import and export users and customers
≤2.5.1Update to 2.5.2
- Medium6.6Authenticated (Admin+) PHP Object Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- High7.2Authenticated (Admin+) Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery
Import and export users and customers
≤2.4.4Update to 2.4.5
- Low2.7Authenticated (Admin+) Insecure Direct Object Reference
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset
VW Writer Blog
≤1.3.8Update to 1.3.9
- High7.2Authenticated (Admin+) Privilege Escalation
Import and export users and customers
≤2.5.1Update to 2.5.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.8Update to 4.16.9
- Medium6.46.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer
6.0.0 – 6.3.0Update to 6.3.1
- High7.3Unauthenticated Privilege Escalation
SAML Single Sign On – SSO Login
≤5.4.7Update to 6.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.24.0Update to 1.25.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
≤3.2.16Update to 3.2.17