Database
WordPress Vulnerability Database (page 132)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.39.8.0 - Unauthenticated Payment Bypass
Booking for Appointments and Events Calendar – Amelia
9.0 – 9.8.0Update to 9.8.1
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤4.7.5Update to 4.7.6
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Option Modification
Notiqoo – Order Notification & Customer Chat for WooCommerce
<1.4.14Update to 1.4.14
- Medium5.3Unauthenticated Information Exposure
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.5.9Update to 8.6.0
- High7.51.2.14 - Unauthenticated SQL Injection
Quentn WP
1.2.13 – 1.2.14Update to 1.2.15
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
WebTotem Backups
<1.1.0Update to 1.1.0
- Critical9.8Authentication Bypass to Admin
Frontegg SAML SSO
≤1.0.1No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.5Update to 11.2.6
- Medium4.3Cross-Site Request Forgery
Site Kit by Google – Analytics, Search Console, AdSense, Speed
≤1.186.0Update to 1.187.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Visual Composer Website Builder
≤45.16.1Update to 45.16.2
- High8.8Authenticated (Author+) Arbitrary File Upload
Insert or Embed Articulate Content into WordPress
<4.3000000025Update to 4.3000000027
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
Redux Framework
≤4.5.13.1Update to 4.5.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
Aruba HiSpeed Cache
≤3.0.14Update to 3.0.15
- Medium6.1Reflected Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.46Update to 1.15.47
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field
Easy Google Fonts
≤2.0.4No patch available
- Medium4.3Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'
Advanced Contact form 7 DB
≤2.1.3No patch available
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
WP BackItUp Community Edition
≤2.1.0No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
Builderall for WordPress
≤3.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting
Builderall for WordPress
≤3.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting
Builderall for WordPress
≤3.0.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter
Sidebar Manager Light
≤1.18No patch available
- High8.0Authenticated (Subscriber+) Arbitrary Password Reset
Bulk Password Reset
≤1.3.3No patch available
- High7.5Unauthenticated Arbitrary File Read via 'file_id' Path Segment
Direct Download for WooCommerce
≤1.19No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via 'type' Parameter
Drag and Drop File Upload for Elementor Forms
≤1.6.0Update to 1.6.1
- High7.5Unauthenticated SQL Injection
Verified Reviews (Avis Vérifiés)
≤2.4.6No patch available
- High8.8Authenticated (Subscriber+) Remote Code Execution
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1224Update to 4.1225
- Medium5.3Unauthenticated Email Header Injection
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
<4.1.9Update to 4.1.9
- Medium5.3Missing Authorization
WP Fast Total Search – The Power of Indexed Search
≤1.82.284Update to 1.83.286
- Medium5.36.2.5 - Unauthenticated Information Exposure
Kirki – Freeform Page Builder, Website Builder & Customizer
6.2.1 – 6.2.5Update to 6.3.0
- Medium5.32.3.3 - Unauthenticated Information Exposure
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
1.3.1 – 2.3.3Update to 3.4.0