Database
WordPress Vulnerability Database (page 121)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Authenticated (Administrator+) SQL Injection
MoreConvert Wishlist for WooCommerce
≤1.9.21Update to 2.0.0
- Medium5.3Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
Motors – Car Dealership & Classified Listings Plugin
≤1.4.120Update to 1.4.121
- Medium5.32.1.6 - Unauthenticated Information Exposure
MgoSync – European dropshipping and suppliers
2.1.5 – 2.1.6Update to 2.1.7
- Medium5.5Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Medium4.3Authenticated (Contributor+) Path Traversal via REST Templates Controller
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Medium4.3Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Medium4.3Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
Auto Upload Images
≤3.3.2Update to 3.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
≤2.8.0Update to 2.9.0
- Medium4.3Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Medium5.3Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
≤2.34.6Update to 2.34.7
- Medium4.3Forced Theme Install/Preview and Selector Injection via Theme Installer Route
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Low3.7HTML API set_modifiable_text() Comment Boundary Break
WordPress
≤7.1Update to 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Low2.7Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Medium5.3Missing Authorization
Botiga Pro
≤1.6.4Update to 1.6.5
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via Media Import
Use-your-Drive | Google Drive plugin for WordPress
2.0 – 3.8.3Update to 3.9.0
- Medium5.3Missing Authorization
Mailchimp for WooCommerce
≤6.1.0Update to 6.1.1
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.3Update to 1.2.4
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.2Update to 1.2.3
- Medium5.3Unauthenticated Payment Bypass
Payment Gateway for PayPal on WooCommerce
≤9.2.0Update to 9.2.1
- Medium5.3Missing Authorization
WPGraphQL Smart Cache
≤2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.1Update to 28.2
- Medium4.3Missing Authorization
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.9.6Update to 7.9.7
- High7.3Social Login <= 1.5.9 - Unauthenticated Privilege Escalation
UsersWP – Social Login
≤1.5.9Update to 1.5.10
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.0Update to 2.13.1
- Medium4.3Missing Authorization
Unbounce Landing Pages
≤1.1.4Update to 1.1.5
- Critical9.83.5.50 - Unauthenticated Arbitrary File Upload
Ultra Addons for Contact Form 7
3.2.4 – 3.5.50Update to 3.5.51
- Medium6.1Reflected Cross-Site Scripting
Estatik Real Estate Plugin
≤4.3.4Update to 4.3.5