Database
WordPress Vulnerability Database (page 1208)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated SQL Injection
WooCommerce Dropshipping Premium
≤4.3Update to 4.4
- Medium6.5Missing Authorization
Mihdan: Public Post Preview
≤1.9.9Update to 1.9.10
- Medium6.1Reflected Cross-Site Scripting
eCommerce Product Catalog
≤3.0.71Update to 3.0.72
- High8.1Missing Authorization and Cross-Site Request Forgery
Product Stock Manager
<1.0.5Update to 1.0.5
- Medium6.5Authenticated (Administrator+) Arbitrary File Upload via Path Traversal
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
≤3.6.8Update to 3.6.9
- High8.0Authenticated (Subscriber+) CSV Injection
Import and export users and customers
≤1.20.4Update to 1.20.5
- High8.8SQL Injection via Translations
Complianz GDPR/CCPA Cookie Consent Banner
≤6.3.3Update to 6.3.4
- High7.5Missing Authorization to Settings Update
Wp-Hide
≤0.0.2No patch available
- High8.3CSV Injection
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤4.3.12Update to 4.3.13
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Role Based Pricing for WooCommerce
≤1.6.1Update to 1.6.2
- Critical9.8Missing Authorization to PHAR Deserialization
Role Based Pricing for WooCommerce
≤1.6.2Update to 1.6.3
- High7.1Missing Authorization
HBook - Hotel booking system - WordPress Plugin
≤1.0.2No patch available
- Medium6.5Missing Authorization
Account Manager for WooCommerce
≤2.1.1No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Highlight Focus
≤1.1No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Shortcodes Ultimate – Content Elements
≤5.12.0Update to 5.12.1
- Medium6.1Reflected Cross-Site Scripting
WPB Show Core
all versionsNo patch available
- High8.8Cross-Site Request Forgery
Shortcodes Ultimate – Content Elements
≤5.12.0Update to 5.12.1
- High8.8Cross-Site Request Forgery
Page View Count
≤2.5.5Update to 2.5.6
- Medium5.4Prototype Pollution
ElasticPress
≤4.3.1Update to 4.4.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
3com – Asesor de Cookies para normativa española
≤3.4.3No patch available
- High7.1Missing Authorization to Plugin Settings Change
Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms
≤1.0.18Update to 1.0.19
- High7.5AliExpress Dropshipping and Fulfillment for WooCommerce Premium <= 1.1.0 - Sensitive Information Disclosure
ALD - AliExpress Dropshipping and Fulfillment for WooCommerce Premium
≤1.1.0Update to 1.1.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Accessibility
≤1.0.3Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
5 Anker Connect
≤1.2.6Update to 1.2.7
- High8.8Cross-Site Request Forgery
Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms
≤1.0.15Update to 1.0.16
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
AB Press Optimizer
≤1.1.1No patch available
- Low3.7Regular Expression Denial of Service
ElasticPress
≤4.3.1Update to 4.4.0
- Medium6.1Reflected Cross-Site Scripting
WP Smart Import : Import any XML File to WordPress
≤1.0.2Update to 1.0.3
- Low3.7Regular Expression Denial of Service
ElasticPress
≤4.3.1Update to 4.4.0
- Medium6.1Reflected Cross-Site Scripting
eCommerce Product Catalog
≤3.0.69Update to 3.0.70