Database
WordPress Vulnerability Database (page 122)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
WPGraphQL Smart Cache
≤2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Online Scheduling and Appointment Booking System – Bookly
≤28.1Update to 28.2
- Medium4.3Missing Authorization
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.9.6Update to 7.9.7
- High7.3Social Login <= 1.5.9 - Unauthenticated Privilege Escalation
UsersWP – Social Login
≤1.5.9Update to 1.5.10
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.0Update to 2.13.1
- Medium4.3Missing Authorization
Unbounce Landing Pages
≤1.1.4Update to 1.1.5
- Critical9.83.5.50 - Unauthenticated Arbitrary File Upload
Ultra Addons for Contact Form 7
3.2.4 – 3.5.50Update to 3.5.51
- Medium6.1Reflected Cross-Site Scripting
Estatik Real Estate Plugin
≤4.3.4Update to 4.3.5
- Medium4.7Authenticated (Admin+) Privilege Escalation
WP Import Export Lite
≤3.9.34Update to 3.9.35
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.2Update to 3.6.5.3
- High7.2Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
WordPress
≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1
- Medium5.3Missing Authorization
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
≤5.4.6Update to 5.4.7
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.1Update to 1.2.2
- High7.5Unauthenticated SQL Injection
VikRentItems Flexible Rental Management System
≤1.2.3Update to 1.2.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Business Name Generator
≤1.3No patch available
- Medium5.3Missing Authorization
Secure Custom Fields
≤6.9.3Update to 6.9.4
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.9.6Update to 7.9.7
- Medium5.3Unauthenticated Payment Bypass
SUMIT Payment Gateway for WooCommerce
≤3.0.0Update to 4.0.0
- Medium5.3Unauthenticated Email Verification Bypass
FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login
≤2.1.2Update to 3.0.0
- Medium5.3Missing Authorization
Easy Invoice – Invoice Generator, PDF Quotes & Payments
≤2.3.8Update to 2.4.0
- Medium4.3Missing Authorization
Simple Membership
≤4.8.2Update to 4.8.3
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Cooked – Recipe Management
≤1.16.0Update to 1.16.1
- Medium5.3Missing Authorization
Booking Calendar
≤11.7Update to 11.8
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.7Update to 5.2.8
- Medium4.3Cross-Site Request Forgery
Issues and Series for Newspapers, Magazines, Publishers, Writers
≤3.1.3Update to 3.1.4
- Medium4.3Cross-Site Request Forgery
Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility
≤7.1.0.43Update to 7.1.0.44
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Geo Mashup
≤1.13.21Update to 1.13.22
- Medium5.3Missing Authorization
BerqWP – WordPress Performance Plugin
≤4.1.15Update to 4.1.16
- High8.1Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
Paid Downloads
≤3.15No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via Chunked File Upload
Multi Uploader for Gravity Forms
≤1.1.9No patch available