Database
WordPress Vulnerability Database (page 128)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Privilege Escalation
WP Component
≤2.2.4No patch available
- Medium4.34.0.7 - REST API Authentication Confusion
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Hoo Companion
1.0.2 – 1.0.2No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
WP images upload on piclect
≤1.0No patch available
- High8.1Unauthenticated PHP Object Injection
IDB Ecommerce (wpStoreCart 5)
≤5.0.7No patch available
- Medium4.3Missing Authorization to 2FA Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.1Update to 9.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
BE REST Endpoints
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery
Export & Import WPBakery Page Builder
≤1.0.2No patch available
- High7.5Unauthenticated SQL Injection
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard
≤4.1.0Update to 4.2.0
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Booking for Appointments and Events Calendar – Amelia
<2.4.10Update to 2.4.10
- Medium4.9Authenticated (Admin+) SQL Injection
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.9Authenticated (Admin+) SQL Injection
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.2Authenticated (Admin+) Arbitrary File Upload
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.2Authenticated (Admin+) Remote Code Execution
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.15Update to 5.0.16
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.34Update to 6.35
- Medium6.4Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
Bridge - Creative Multipurpose WordPress Theme
≤30.8.9.1Update to 30.8.9.2
- High7.2Unauthenticated Arbitrary HTML Injection in Notification Emails
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1066Update to 1.7.1067
- Medium5.3Unauthenticated Information Exposure
Bookit — Booking & Appointment Calendar
<2.6.0.1Update to 2.6.0.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
rtMedia for WordPress, BuddyPress and bbPress
<4.7.12Update to 4.7.12
- Medium5.3Missing Authorization
Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings
≤3.5.1Update to 3.5.2
- Medium5.35.2.7 - Unauthenticated Information Exposure
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
5.0 – 5.2.7Update to 5.2.8
- Medium4.3Authenticated (Contributor+) Information Exposure
WP Directory Kit
≤1.6.0Update to 1.6.1
- Medium4.71.9.8 - Authenticated (Administrator+) Privilege Escalation
Temporary Login Without Password
1.5 – 1.9.8Update to 1.9.9
- Medium4.33.4.0 - Authenticated (Custom Role+) Insecure Direct Object Reference
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
1.14.0 – 3.4.0Update to 3.4.1
- Medium5.3Unauthenticated Information Exposure
WP Directory Kit
<1.6.1Update to 1.6.1
- Medium4.3Missing Authorization
Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More
<3.1.1Update to 3.1.1
- Medium4.3Cross-Site Request Forgery
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
<1.2.2Update to 1.2.2
- Medium4.9Authenticated (Editor+) SQL Injection
WP Directory Kit
≤1.5.8Update to 1.5.9
- Medium5.3Missing Authorization
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
<8.5.7Update to 8.5.7