Database
WordPress Vulnerability Database (page 127)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.3Update to 4.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.11Update to 4.2.12
- High7.5Unauthenticated SQL Injection
Album Cover Finder
≤0.7.0No patch available
- Medium5.3Unauthenticated Information Exposure
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66
- Critical9.8Unauthenticated Arbitrary File Upload
DS Ad Rotator
≤0.8No patch available
- Medium6.3Authenticated (Author+) Privilege Escalation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
<5.2.8Update to 5.2.8
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.9Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.21.5.34 - Unauthenticated Stored Cross-Site Scripting
GenieWords
1.5.27 – 1.5.34No patch available
- Critical9.8Unauthenticated Remote Code Execution via Dynamic Render Field Type
Advanced Custom Fields: Extended PRO
≤0.9.2.6Update to 0.9.2.7
- Medium4.38.7.5 - Missing Authorization
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
8.7.2 – 8.7.5Update to 8.7.6
- Medium4.3Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.14Update to 2.0.15
- High7.210.3 - Unauthenticated Stored Cross-Site Scripting
YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin
10.0 – 10.3No patch available
- Medium5.3Unauthenticated Information Exposure
Zonify – Amazon Product Importer for WooCommerce
<1.0.5Update to 1.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤4.0.7Update to 4.0.8
- High7.5Unauthenticated Arbitrary File Read
Yogeta WP Cloud
≤1.0No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
YayPricing – WooCommerce Dynamic Pricing & Discounts
<3.5.7Update to 3.5.7
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium6.35.2.7 - Authenticated (Subscriber+) Privilege Escalation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
4.4.6 – 5.2.7Update to 5.2.8
- Medium4.3Authenticated (Subscriber+) Information Exposure
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.14Update to 2.0.15
- Medium5.3Unauthenticated Payment Bypass
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Xpro Addons — 150+ Widgets for Elementor
≤1.7.8Update to 1.7.9
- Medium5.3Unauthenticated Insecure Direct Object Reference
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66
- High7.5Unauthenticated SQL Injection
SAMO Forms
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.9Authenticated (Admin+) Arbitrary File Read
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.2Authenticated (Admin+) Remote Code Execution
WP Import Export Lite
≤3.9.33Update to 3.9.34
- Medium4.3Cross-Site Request Forgery
Subscriptions for WooCommerce
≤2.0.2Update to 2.0.3
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Add User Autocomplete
<1.2Update to 1.2
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7