Database
WordPress Vulnerability Database (page 126)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Visitor Traffic Real Time Statistics pro
≤11.21Update to 11.22
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Inventory Manager
≤2.5.4Update to 2.5.5
- High7.5Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.7Update to 3.7.8
- Medium5.3Unauthenticated Sensitive Information Exposure in 'id' Parameter
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
≤1.16.20Update to 1.16.21
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
≤4.15.0Update to 4.16.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets
≤4.9.5Update to 4.9.6
- Medium5.3Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter
JWT Authentication for WP REST APIs
≤4.7.0Update to 4.8.0
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Information Exposure
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
≤1.2.7Update to 1.2.8
- Medium4.3Missing Authorization
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Information Exposure
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard
≤4.1.0Update to 4.2.0
- High8.8Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
Consulting - Business, Finance WordPress Theme
≤6.7.16Update to 6.7.17
- Medium4.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium5.4Unauthenticated Open Redirect
Newsletter
≤9.3.6Update to 9.3.7
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium4.3Authenticated (Board Member+) Comment Author Spoofing
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.14Update to 2.0.15
- Medium5.3Unauthenticated Insecure Direct Object Reference
kboard
≤6.6Update to 6.7
- Medium5.3Unauthenticated Information Exposure
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
≤1.2.7Update to 1.2.8
- Medium5.3Unauthenticated Information Exposure
Subscriptions for WooCommerce
≤2.0.2Update to 2.0.3
- Medium5.3Missing Authorization
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
<1.2.0Update to 1.2.0
- Medium4.3Authenticated (Subscriber+) Full Admin Area Denial of Service
Seraphinite Accelerator
≤2.29.23Update to 2.29.24
- Medium5.3Unauthenticated Appointment Slot Capacity Bypass
Appointment Hour Booking – Booking Calendar
≤1.5.94Update to 1.5.95
- Medium6.1Reflected Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Content Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.34Update to 6.35
- Medium4.3Authenticated (Subscriber+) Information Exposure
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- High7.3Unauthenticated Privilege Escalation
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.8.0Update to 4.16.8.1