Database
WordPress Vulnerability Database (page 125)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
≤5.1.0Update to 5.1.1
- Medium4.3Missing Authorization
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.2Update to 2.1.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.3.7Update to 5.3.8
- High7.5Unauthenticated Arbitrary File Donwload
design-scuole-wordpress-theme
2.6.0 – 2.18.1No patch available
- Medium6.1Reflected Cross-Site Scripting
design-scuole-wordpress-theme
1.0 – 2.18.2No patch available
- High7.21.6 - Unauthenticated Stored Cross-Site Scripting
To Do List Member
1.4 – 1.6No patch available
- Critical9.8Authentication Bypass
Login with QR
≤1.0.0No patch available
- Critical9.8Authentication Bypass
Private Feed Key
≤0.1No patch available
- Medium5.34.4.6 - Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
4.4.3 – 4.4.6Update to 4.4.7
- Medium6.1Reflected Cross-Site Scripting
Dictionary
≤1.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
EWWW Image Optimizer
≤8.7.6Update to 8.7.7
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
PuppyFW
≤0.4.4No patch available
- Critical9.8Unauthenticated Remote Code Execution
wpShopGermany IT-RECHT KANZLEI
≤2.3Update to 2.4
- Medium4.32.5.3 - Authenticated (Author+) Information Exposure
Comments Import & Export
2.1.11 – 2.5.3Update to 2.5.4
- Medium5.3Missing Authorization
design-scuole-wordpress-theme
1.0 – 2.17.3No patch available
- Medium5.3Unauthenticated Information Exposure
Newsletter
≤9.3.7Update to 9.3.8
- High7.3Unauthenticated Arbitrary Account Takeover
Headless SSO Plugin for WP
≤1.7.0Update to 1.7.1
- Medium5.3Unauthenticated Payment Bypass
Robokassa payment gateway for Woocommerce
≤1.8.8Update to 1.8.9
- Medium6.1Reflected Cross-Site Scripting
Realtyna Organic IDX plugin + WPL Real Estate
≤5.4.1Update to 5.4.2
- Medium5.3Unauthenticated Payment Bypass
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.8Update to 3.0.9
- Medium4.7Open Redirect
design-scuole-wordpress-theme
1.0 – 2.17.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Dictionary
≤1.0No patch available
- Medium6.43.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
3.2.0 – 3.2.5Update to 3.2.6
- Critical9.8Unauthenticated Privilege Escalation
Choose User Role at Registration for WooCommerce
≤1.3.2Update to 1.3.3
- Medium5.3Unauthenticated Information Exposure
EduAdmin Booking
≤5.4.2Update to 6.0.0
- Medium4.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.5.0Update to 5.6.0
- High7.51.3.1 - Unauthenticated SQL Injection
Yo
1.1 – 1.3.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Dewa Kirim – WooCommerce Gojek / Gosend
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.3Update to 4.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
Job Postings
≤2.8.1Update to 2.8.2