Database
WordPress Vulnerability Database (page 130)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
≤4.10.0Update to 4.10.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
≤5.9.9Update to 5.9.10
- Medium4.3Missing Authorization
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.2.2Update to 3.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
Booking for Appointments and Events Calendar – Amelia
≤2.4.9Update to 2.4.10
- Medium5.3Missing Authorization
MDJM Event Management
<1.7.8.5Update to 1.7.8.5
- Medium4.34.0.5 - Authenticated (Contributor+) Insecure Direct Object Reference
Visualizer – Tables & Charts Manager with Built-in AI Generator
4.0.0 – 4.0.5Update to 4.0.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Gato GraphQL
≤19.2.3Update to 19.2.4
- Medium5.3Missing Authorization
zipMoney(Zip Co) Payments Plugin for WooCommerce
<2.4.0Update to 2.4.0
- Medium4.35.7.4 - Missing Authorization
BackWPup – WordPress Backup & Restore Plugin
5.2.2 – 5.7.4Update to 5.7.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Featured Image with URL
<1.0.6Update to 1.0.6
- Medium6.42.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
AI Builder – Generate pages, blocks, images & translate with AI
2.4.1 – 2.7.7Update to 2.7.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Gutenverse News – News Blocks for Blog & Magazine Sites
<3.3.3Update to 3.3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CoolClock
<4.3.8Update to 4.3.8
- Medium6.31.1.2 - Authenticated (Contributor+) Privilege Escalation
Registration Form for WooCommerce
1.1.0 – 1.1.2Update to 1.1.3
- High7.2Unauthenticated Open Redirect
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
<5.2.8Update to 5.2.8
- Medium5.3Unauthenticated Information Exposure
Contact Form to Chat Apps | Click to Chat to Order – FormyChat
≤2.15.7Update to 2.15.8
- Medium5.3Missing Authorization
Passster – Password Protect Pages and Content
≤4.3.13Update to 4.3.14
- Medium4.9Authenticated (Editor+) SQL Injection
Booking for Appointments and Events Calendar – Amelia
≤2.4.9Update to 2.4.10
- Medium4.9Authenticated (Editor+) SQL Injection
Sky Addons for Elementor – 160+ Widgets, GSAP Animations, Templates & Theme Builder
≤3.8.4Update to 3.8.5
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.9Update to 4.0.0
- High8.1Unauthenticated PHP Object Injection
ThemeREX Addons
<2.45.0Update to 2.45.0
- High8.1Unauthenticated PHP Object Injection
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.0Update to 3.6.1
- Medium5.3Unauthenticated Information Exposure
ElasticPress
≤5.3.4Update to 5.3.5
- High8.8Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation
MemberPress Corporate Accounts
≤1.5.39Update to 1.6.0
- Medium4.3Insecure Direct Object Reference to Notifications Deletion
BuddyPress
≤14.3.3Update to 14.3.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.23Update to 1.0.24
- Medium6.1Reflected Cross-Site Scripting
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
≤1.4.3Update to 1.4.3.1
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.16Update to 2.0.17
- Medium6.1Reflected Cross-Site Scripting
WP-Members Membership Plugin
≤3.5.6Update to 3.5.7