Database
WordPress Vulnerability Database (page 131)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Themify – WooCommerce Product Filter
≤1.5.5Update to 1.5.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
≤2.10.2Update to 2.10.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Ajax Chat – Add a Fast, Secure Chat Box
≤20260811Update to 20260827
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Photo Album Plus
≤9.2.08.003Update to 9.2.10.001
- High7.5Unauthenticated SQL Injection
Unlimited Elements for Elementor
≤2.0.16Update to 2.0.17
- High7.5Unauthenticated SQL Injection
Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons
≤1.4.2Update to 1.4.3
- Medium6.1Reflected Cross-Site Scripting
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
≤3.5.9Update to 3.6.0
- Medium6.1Reflected Cross-Site Scripting
Relevanssi – A Better Search
≤4.28.1Update to 4.28.2
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.70Update to 1.2.71
- Medium5.3Unauthenticated Authentication Bypass via Brute Force
OTP Login & Register Woocommerce
≤2.7.2Update to 2.7.3
- Medium6.5Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤2.0.8Update to 2.0.9
- Critical9.8Unauthenticated Arbitrary File Upload
MIPL Checkout Fields Manager for WooCommerce – Customize, Organize & Group Checkout Fields.
≤1.2.2Update to 1.2.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.9.7Update to 7.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Bold Timeline Lite
≤1.2.8Update to 1.3.0
- High7.5Unauthenticated Arbitrary File Read via 'user[name]' Parameter
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.0.4Update to 11.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
Media Library Assistant
≤3.35Update to 3.36
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
Media Library Assistant
≤3.35Update to 3.36
- Medium5.3Payment Bypass to Unauthenticated Arbitrary Booking Price and Payment Method Bypass
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
<1.2.0Update to 1.2.0
- Critical9.11.2.2 - Unauthenticated Arbitrary File Deletion
CryptoPayment Gateway
1.2.1 – 1.2.2No patch available
- Medium4.3Authenticated (Custom Role+) Persistent Access After Login Revocation
Temporary Login Without Password
<1.9.9Update to 1.9.9
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard
≤1.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
Media Library Assistant
≤3.35Update to 3.36
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.21Update to 2.3.22
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.24Update to 1.0.25
- Medium4.3Cross-Site Request Forgery
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.1.5Update to 2.1.6
- Medium4.3Missing Authorization
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.0Update to 3.4.1
- Medium5.3Missing Authorization
Advanced Partial Payment or Deposit for WooCommerce
≤3.1.0Update to 4.0.1
- Medium5.33.2.9 - Unauthenticated Information Exposure
Ultimate Gift Cards for WooCommerce
3.0.3 – 3.2.9Update to 3.2.10
- High7.5Authenticated (Subscriber+) PHP Object Injection
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.0Update to 3.4.1
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Gpx2Graphics
≤0.3No patch available