Database
WordPress Vulnerability Database (page 1191)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Builder forms Addon For WordPress (<= 5.9.2), Himer (<= 1.9.3) and Discy (<= 5.5.3) - Authenticated (Subscriber+) Insecure Direct Object Reference
WPQA - Builder forms Addon For WordPress
≤5.9.2Update to 5.9.3
- Critical9.8Unauthenticated SQL Injection
Cryptocurrency Widgets Pack
≤1.8.1Update to 2.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Responsive Starter Templates – Elementor Templates & Starter Sites
≤2.6.8Update to 2.6.9
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Responsive Starter Templates – Elementor Templates & Starter Sites
≤2.6.8Update to 2.6.9
- Medium5.4Missing Authorization
Advanced Product Labels for WooCommerce
≤1.2.4Update to 1.2.4.1
- High7.2Authenticated (Administrator+) PHP Object Injection
WP Custom Admin Interface
≤7.28Update to 7.29
- High8.8Missing Authorization Checks
LWS SMS
≤2.1Update to 2.1.5
- High8.8Authenticated SQL Injection
Web Invoice – Invoicing and billing for WordPress
≤2.1.3No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Quote-O-Matic
≤1.0.5No patch available
- High8.8Cross-Site Request Forgery
Launchpad – Coming Soon & Maintenance Mode Plugin
≤1.0.13No patch available
- Medium4.1Authenticated (Administrator+) Arbitrary Log File Download
Wholesale Market for WooCommerce
<2.0.0Update to 2.0.0
- High8.8Cross-Site Request Forgery
Conditional Shipping for WooCommerce
≤2.3.1Update to 2.3.2
- High7.2Authenticated (Administrator+) SQL Injection
multimedial images
≤1.0bNo patch available
- Medium5.3User Enumeration Bypass via REST API
WP Cerber Security, Anti-spam & Malware Scan
≤9.3.2Update to 9.3.3
- Medium6.1Reflected Cross-Site Scripting
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤2.9.14Update to 2.9.15
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Universal Star Rating
≤1.10.4Update to 2.0.0
- High8.8Authenticated SQL Injection
Web Invoice – Invoicing and billing for WordPress
≤2.1.3No patch available
- High8.8Cross-Site Request Forgery
OWM Weather
≤5.6.11Update to 5.6.12
- Critical9.8Unauthenticated SQL Injection via AJAX action
LetsRecover – WooCommerce Abandoned Cart Notifications
≤1.1.0Update to 1.2.0
- High7.5Information Disclosure via Unauthenticated Arbitrary File Download
Wholesale Market
≤2.2.0Update to 2.2.1
- High8.8Authenticated (Subscriber+) Privilege Escalation
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
≤3.3.2Update to 3.3.3
- Medium6.1Reflected Cross-Site Scripting via REQUEST_URI
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤4.9.2Update to 4.9.3
- High8.1Missing Authorization
Robo Gallery – Photo & Image Slider
≤3.2.9Update to 3.2.11
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Change
Genial Comments
≤1.7.2Update to 1.7.3
- High7.2Unauthenticated SQL Injection
WP AutoComplete Search
≤1.0.4No patch available
- Medium6.5Improper Input Restriction Validation
demon image annotation
≤5.0Update to 5.1
- Medium5.59.8.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )
9.8.1 – 9.8.4Update to 9.8.5
- Medium6.1Reflected Cross-Site Scripting
Clearpay Gateway for WooCommerce
≤3.5.0Update to 3.5.1
- Medium5.3Information Disclosure
All-In-One Security (AIOS) – Security and Firewall
≤5.1.2Update to 5.1.3
- Medium6.1Reflected Cross-Site Scripting
Vietnam Checkout for WooCommerce
≤2.0.4Update to 2.0.5