Database
WordPress Vulnerability Database (page 124)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Contributor+) Information Exposure
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.80Update to 51.1.81
- Medium4.3Missing Authorization
Filter Gallery
≤1.1.4Update to 1.1.5
- High7.51.3.31 - Authenticated (Contributor+) Local File Inclusion
All Bootstrap Blocks
1.3.20 – 1.3.31No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All Bootstrap Blocks
≤1.3.31No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
iGMS Direct Booking
≤1.0Update to 2.0
- High7.21.4.1.4 - Unauthenticated Stored Cross-Site Scripting
Master Blocks – Ultimate Blocks for Marketers
1.4.1 – 1.4.1.4Update to 1.5.0
- High7.5Unauthenticated SQL Injection
Tz Weekly Radio Schedule
≤1.8.1No patch available
- High7.5Unauthenticated SQL Injection
Tz Weekly Radio Schedule
≤1.8.1No patch available
- High7.5Unauthenticated SQL Injection
wp shortcut link and advertisement baner
≤1.2.0No patch available
- Medium5.3Unauthenticated Payment Bypass
RestroPress – Online Food Ordering System
≤3.4.5Update to 3.4.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
RestroPress – Online Food Ordering System
<3.4.8Update to 3.4.8
- Medium4.7Authenticated (Admin+) Privilege Escalation
All-in-One WP Migration and Backup
≤7.110Update to 7.111
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.1Update to 28.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
Bold Page Builder
≤5.9.6Update to 5.9.7
- Medium6.1Reflected Cross-Site Scripting via 'icn' Parameter
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.22Update to 2.15.23
- High7.2Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request
WP-Lister Lite for eBay
≤3.8.9Update to 3.8.10
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
Advanced Popups
≤1.2.3Update to 1.2.4
- Medium5.3Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.16Update to 2.8.17
- Medium6.5Authenticated (Custom+) SQL Injection via 'order_by' Parameter
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
Getwid – Gutenberg Blocks
2.1.3 – 2.1.3Update to 2.2.0
- High8.8Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤32.0.1Update to 33.0.0
- Critical9.8Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
TrueBooker – Appointment Booking and Scheduler System
≤1.2.3Update to 1.2.4
- Critical9.8Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.2Update to 3.6.2.1
- Critical9.8Unauthenticated Remote Code Execution
Migratico Lite
≤2.6.8Update to 2.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
MotoPress Hotel Booking
≤6.2.4Update to 6.3.0
- Critical9.8Authentication Bypass
The Pressengine
≤1.0No patch available
- Critical9.82.36 - Backdoored Software
Admin Menu Editor Pro
2.35 – 2.36No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Motors – Car Dealership & Classified Listings Plugin
≤1.4.120Update to 1.4.121
- Medium5.3Missing Authorization
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.1.8Update to 3.1.9
- Medium5.3Missing Authorization
Autopay
≤5.0.0Update to 5.0.1