Database
WordPress Vulnerability Database (page 124)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
wp shortcut link and advertisement baner
≤1.2.0No patch available
- Medium5.3Unauthenticated Payment Bypass
RestroPress – Online Food Ordering System
≤3.4.5Update to 3.4.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
RestroPress – Online Food Ordering System
<3.4.8Update to 3.4.8
- Medium4.7Authenticated (Admin+) Privilege Escalation
All-in-One WP Migration and Backup
≤7.110Update to 7.111
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.1Update to 28.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
Bold Page Builder
≤5.9.6Update to 5.9.7
- Medium6.1Reflected Cross-Site Scripting via 'icn' Parameter
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.22Update to 2.15.23
- High7.2Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request
WP-Lister Lite for eBay
≤3.8.9Update to 3.8.10
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
Advanced Popups
≤1.2.3Update to 1.2.4
- Medium5.3Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.16Update to 2.8.17
- Medium6.5Authenticated (Custom+) SQL Injection via 'order_by' Parameter
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
Getwid – Gutenberg Blocks
2.1.3 – 2.1.3Update to 2.2.0
- High8.8Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤32.0.1Update to 33.0.0
- Critical9.8Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
TrueBooker – Appointment Booking and Scheduler System
≤1.2.3Update to 1.2.4
- Critical9.8Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.2Update to 3.6.2.1
- Critical9.8Unauthenticated Remote Code Execution
Migratico Lite
≤2.6.8Update to 2.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
MotoPress Hotel Booking
≤6.2.4Update to 6.3.0
- Critical9.8Authentication Bypass
The Pressengine
≤1.0No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Motors – Car Dealership & Classified Listings Plugin
≤1.4.120Update to 1.4.121
- Medium5.3Missing Authorization
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.1.8Update to 3.1.9
- Medium5.3Missing Authorization
Autopay
≤5.0.0Update to 5.0.1
- Medium4.3Missing Authorization
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
≤5.1.0Update to 5.1.1
- Medium4.3Missing Authorization
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.2Update to 2.1.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.3.7Update to 5.3.8
- High7.5Unauthenticated Arbitrary File Donwload
design-scuole-wordpress-theme
2.6.0 – 2.18.1No patch available
- Medium6.1Reflected Cross-Site Scripting
design-scuole-wordpress-theme
1.0 – 2.18.2No patch available
- High7.21.6 - Unauthenticated Stored Cross-Site Scripting
To Do List Member
1.4 – 1.6No patch available
- Critical9.8Authentication Bypass
Login with QR
≤1.0.0No patch available
- Critical9.8Authentication Bypass
Private Feed Key
≤0.1No patch available
- Medium5.34.4.6 - Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
4.4.3 – 4.4.6Update to 4.4.7