Database
WordPress Vulnerability Database (page 1285)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Lack of Origin Validation
CardGate Payments for WooCommerce
<3.1.16Update to 3.1.16
- Medium6.4Authenticated Stored Cross-Site Scripting
Modula Image Gallery – Photo Grid & Video Gallery
<2.2.5Update to 2.2.5
- High8.8Cross-Site Request Forgery
Easy Property Listings
<3.4Update to 3.4
- Medium6.4Stored Cross-Site Scripting
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
<1.5.9Update to 1.5.9
- Critical9.8Improper Access Control to Privilege Escalation
wpCentral
≤1.5.0Update to 1.5.1
- Critical9.82.6.7.6 - PHP Object Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
2.2.8 – 2.6.7.6Update to 3.0
- Critical9.91.6.1 - Authorization Bypass to Site Reset
Starter Templates & Sites Pack by ThemeGrill
1.3.4 – 1.6.1Update to 1.6.2
- High8.1Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.3Update to 4.6.0.3
- Medium6.4Authenticated Stored Cross-Site Scripting and Authorization Bypass
CookieYes – Cookie Banner, Cookie Consent & Cookie Notice for GDPR/CCPA
≤1.8.2Update to 1.8.3
- High7.5SQL Injection
Participants Database
<1.9.5.6Update to 1.9.5.6
- Critical9.88.6 - Authentication Bypass
Indeed Membership Pro
7.3 – <8.6.1Update to 8.6.1
- Medium6.38.6 - Missing Authorization Checks
Indeed Membership Pro
7.3 – 8.6Update to 8.6.1
- High7.5Unauthenticated Information Disclosure
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.5Update to 5.5.1
- High8.0Authenticated (Subscriber+) Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.0.3Update to 0.9.0.3
- High8.8Cross-Site Request Forgery
Tutor LMS – eLearning and online course solution
<1.5.3Update to 1.5.3
- Medium6.4Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.23Update to 3.4.23
- High8.0Authenticated (Author+) CSV Injection
TablePress – Tables in WordPress made easy
≤1.14Update to 2.0
- Medium6.1Stored Cross Site Scripting
Strong Testimonials
≤2.40.0Update to 2.40.1
- High8.8Cross-Site Request Forgery
Htaccess by BestWebSoft – WordPress Website Access Control Plugin
≤1.8.1Update to 1.8.2
- Medium6.4Cross-Site Scripting
gistpress
<3.0.2Update to 3.0.2
- Medium6.13.11.2 - Cross-Site Scripting
Login by Auth0
3.11.0 – 3.11.2Update to 3.11.3
- Medium6.1Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.1Update to 4.6.0.3
- High8.8Cross-Site Request Forgery to Remote Code Execution
Code Snippets
≤2.13.3Update to 2.14.0
- Medium6.1Reflected Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.8.4Update to 2.8.5
- Medium6.1Cross-Site Scripting
SAML Single Sign On – SSO Login
≤4.8.83Update to 4.8.84
- Critical9.8Authentication Bypass
Wordable – Export Google Docs to WordPress
<3.1.2Update to 3.1.2
- Medium5.3Hidden Login Page Location Disclosure
WPS Hide Login
≤1.5.4.2Update to 1.5.5
- Medium5.4Authenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤1.0.353Update to 1.0.354
- Medium6.1Cross-Site Scripting
Chatbot with IBM watsonx Assistant
<0.8.21Update to 0.8.21
- Medium5.3Insecure Direct Object Reference via order_id Parameter
WooCommerce
<4.7.0Update to 4.7.0