Database
WordPress Vulnerability Database (page 1198)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Easy Video Player
≤1.2.2.2Update to 1.2.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Checkout for PayPal
≤1.0.13Update to 1.0.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Stripe Checkout
≤1.2.2.20Update to 1.2.2.21
- Medium6.5Authenticated (Subscriber+) Arbitrary File Download
SMSA Shipping for WooCommerce
≤1.0.4Update to 1.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Flowplayer Video Player
≤1.0.4Update to 1.0.5
- Medium5.4Cross-Site Request Forgery leading to Arbitrary Custom Role Creation/Deletion
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.6.6Update to 5.6.7
- Critical9.8Unauthenticated Arbitrary File Upload
Motors – Car Dealership & Classified Listings Plugin
≤1.4.3Update to 1.4.4
- Medium5.5Authenticated (Administrator+) Cross-Site Scripting
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
≤5.4.2Update to 5.4.3
- High8.8Authenticated (Subscriber+) SQL Injection
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.4.19Update to 5.5.0
- Medium6.5IP Spoofing to Protection Mechanism Bypass
All-In-One Security (AIOS) – Security and Firewall
≤5.0.7Update to 5.0.8
- Medium5.4Missing Authorization to Arbitrary Options Deletion
DPD Baltic Shipping
≤1.2.56Update to 1.2.57
- Medium4.3Missing Authorization Checks to Private Page/Post Data Disclosure
Betheme
≤26.6.2Update to 26.6.3
- Medium5.5Authenticated (Administrator+) Cross-Site Scripting
Minimal Coming Soon – Coming Soon Page
≤2.33Update to 2.35
- Medium4.3Missing Authorization to Theme Settings Update
Betheme
≤26.6.2Update to 26.6.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Betheme
≤26.6.2Update to 26.6.3
- Critical9.8Unauthenticated Arbitrary File Upload
Listingo
≤3.2.5Update to 3.2.7
- High8.8Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.4.2.1Update to 7.4.2.2
- Critical9.8Unauthenticated Arbitrary File Upload
Booking calendar, Appointment Booking System
≤3.2.1Update to 3.2.2
- High8.8Missing Authorization Check on Core Functionality
Betheme
≤26.6.1Update to 26.6.3
- Medium4.3Missing Authorization to Post Status Change
Betheme
≤26.6.2Update to 26.6.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤2.2.4Update to 2.2.41
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Welcart e-Commerce
≤2.8.3Update to 2.8.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Livemesh Addons by Elementor
≤7.2.3Update to 7.2.4
- Critical9.8Unauthenticated SQL Injection
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤3.7.5Update to 3.7.6
- Medium6.5Missing Authorization to Arbitrary Plugin Install
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
≤4.19Update to 4.20
- Medium5.4Missing Authorization
Welcart e-Commerce
≤2.8.3Update to 2.8.4
- Medium4.3Missing Authorization to Post Title Change
Betheme
≤26.6.2Update to 26.6.3
- Critical9.8Unauthenticated PHP Object Injection
Cooked Pro
<1.7.5.7Update to 1.7.5.7
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Image Hover Effects – WordPress Plugin
≤5.4Update to 5.5
- Medium5.5Authenticated (Administrator+) Cross-Site Scripting
External Links – nofollow, noopener & new window
≤2.55Update to 2.56