Database
WordPress Vulnerability Database (page 123)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.44Update to 1.8.45
- Medium5.3Unauthenticated Insufficient Credential Protection via Authorization Basic Header
All-in-One WP Migration and Backup
≤7.110Update to 7.111
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Mega Menu
≤1.4.2No patch available
- Medium5.3Unauthenticated Payment Bypass
UpsellWP – Upsell and Related Products Offers for WooCommerce
≤2.2.9Update to 2.2.10
- Medium4.3Missing Authorization
Blog2Social: Social Media Auto Post & Scheduler
≤9.0.0Update to 9.1.0
- Medium5.3Unauthenticated Unbounded Option Growth
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.2Update to 9.8.3
- Medium5.3Unauthenticated Account Registration
Clean Login
≤1.18Update to 1.19
- High7.2Unauthenticated Server-Side Request Forgery
Generate PDF using Contact Form 7
≤4.2.1Update to 4.2.2
- Medium5.3Unauthenticated CAPTCHA Bypass
Clean Login
≤1.18Update to 1.19
- Medium4.3Insecure Direct Object Reference
Blog2Social: Social Media Auto Post & Scheduler
≤9.0.0Update to 9.1.0
- Medium4.3Missing Authorization
Bookit — Booking & Appointment Calendar
≤2.6.0.4Update to 2.6.0.5
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium5.34.0.2.1 - Unauthenticated Insecure Direct Object Reference
Easy Appointments
4.0 – 4.0.2.1Update to 4.0.2.2
- Medium5.3Missing Authorization
Easy Appointments
≤4.0.2.1Update to 4.0.2.2
- High7.5Unauthenticated SQL Injection
Product Question and Answer
≤1.1.0No patch available
- Medium5.3Unauthenticated Login Protection Bypass
Hide My WP Ghost – Security & Firewall
≤7.0.10Update to 7.0.11
- Medium5.3Unauthenticated Protection Mechanism Bypass
Hide My WP Ghost – Security & Firewall
≤7.0.10Update to 7.0.11
- Medium5.34.1.3 - Missing Authorization
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
4.0.0 – 4.1.3Update to 4.2.0
- High7.24.1.3 - Unauthenticated Stored Cross-Site Scripting
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
4.0.0 – 4.1.3Update to 4.2.0
- High7.21.8.14 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
VikBooking Hotel Booking Engine & PMS
1.8.8 – 1.8.14Update to 1.8.15
- Medium4.351.1.80 - Missing Authorization
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.80Update to 51.1.81
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.80Update to 51.1.81
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium5.3Unauthenticated Cache Poisoning
Breeze Cache
≤2.5.14Update to 2.5.15
- Medium4.3Cross-Site Request Forgery
aVideo
≤29.0No patch available
- Medium4.3Authenticated (Subscriber+) Username Enumeration
Blog2Social: Social Media Auto Post & Scheduler
≤9.0.0Update to 9.1.0
- High7.2Authenticated (Shop Manager+) Remote Code Execution
AF Companion – AI SEO, GEO, Alt Text, Performance & Site Health
≤2.1.0Update to 2.2.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
Nimble Page Builder
≤3.3.8No patch available
- Medium4.3Authenticated (Bookit Staff+) Information Exposure
Bookit — Booking & Appointment Calendar
≤2.6.0.4Update to 2.6.0.5
- High7.5Unauthenticated SQL Injection
Price Drop Alert for Woo Commerce
≤1.1No patch available