Database
WordPress Vulnerability Database (page 129)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.31.2.2 - Unauthenticated Insecure Direct Object Reference
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
1.0.9 – 1.2.2Update to 1.2.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Sprout Invoices – Client Invoicing & Estimates
<20.8.16Update to 20.8.16
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
<1.2.2Update to 1.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Menu Wizard Widget
≤3.3.1No patch available
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
<3.4.1Update to 3.4.1
- Medium5.31.10.0 - Unauthenticated Information Exposure
SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph
1.6.2 – 1.10.0Update to 1.10.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Highlight Box
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
<1.2.2Update to 1.2.2
- Medium6.5Unauthenticated SQL Injection via URL Path
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.1Update to 4.2.2
- High7.5Unauthenticated Local File Inclusion
GEO my WP
≤4.5.5.3Update to 4.5.5.4
- High8.8Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions
DT LMS – elearning, WordPress LMS Plugin
≤1.1Update to 1.2
- High7.5Unauthenticated SQL Injection via 'compare' Parameter
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.11Update to 4.7.12
- Medium6.5Authenticated (Subscriber+) SQL Injection via Parameter Name
Smart Marketing SMS and Newsletters Forms
≤5.1.24Update to 5.1.25
- Critical9.8Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
The Events Calendar
≤6.17.3Update to 6.17.3.1
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
The Events Calendar
≤6.17.4Update to 6.17.4.1
- Medium4.3Missing Authorization
Simple Membership
<4.7.8Update to 4.7.8
- Medium5.33.0.17 - Missing Authorization
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
3.0.10 – 3.0.17Update to 3.0.18
- Medium5.3Unauthenticated Two-Factor Authentication Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.0Update to 9.8.1
- Medium4.3Authenticated (Subscriber+) Payment Bypass to Unpaid Ad Placement Acquisition
Quads Ads Manager for Google AdSense
3.0.4 – 3.0.4Update to 3.0.5
- Medium4.3Authenticated (Subscriber+) Information Exposure
SSL Zen — SSL Certificate Installer & HTTPS Redirects
<4.7.40Update to 4.7.40
- Medium5.3Missing Authorization
YITH WooCommerce Wishlist
<4.18.1Update to 4.18.1
- Medium5.30.9.3 - Unauthenticated Payment Bypass
Payment Gateway PayPay for WooCommerce
0.5 – 0.9.3No patch available
- Medium5.37.6.2 - Unauthenticated Insecure Direct Object Reference
Nexi XPay Build
7.6.1 – 7.6.2No patch available
- High8.1Unauthenticated PHP Object Injection
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.0Update to 3.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Simple Payment
≤2.5.4Update to 2.5.6
- Medium5.3Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1066Update to 1.7.1067
- Medium5.3Unauthenticated Information Exposure
bbPress
≤2.6.14Update to 2.6.15
- High8.18.2.2 - Unauthenticated PHP Object Injection
Site Reviews
7.2.2 – 8.2.2Update to 8.3.0
- Medium6.35.0.15 - Authenticated (Custom Role+) Privilege Escalation
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
5.0.0 – 5.0.15Update to 5.0.16