Database
WordPress Vulnerability Database (page 133)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
BuddyForms
≤2.9.0No patch available
- Medium5.33.5.2 - Unauthenticated Information Exposure
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
3.3.6 – 3.5.2Update to 3.5.3
- Medium5.3Missing Authorization
Robokassa payment gateway for Woocommerce
≤1.8.9Update to 1.9.0
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Advanced Customized Prompts
≤1.0.1No patch available
- Medium5.3Unauthenticated Information Exposure
Teddy Bear Customize Addon
≤1.0.5No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Teddy Bear Customize Addon
≤1.0.5No patch available
- Medium6.41.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Content Mask
1.7.1 – 1.8.5.5Update to 1.8.5.6
- Medium5.32.8.1 - Payment Bypass to Unauthenticated Unauthorized Order Completion
المنتور فارسی
2.7.10 – 2.8.1Update to 2.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WPCS – WordPress Currency Switcher Professional
≤1.3.2Update to 1.3.3
- Medium5.3IP Soofing
IP2Location Country Blocker
≤2.44.0Update to 2.45.0
- High7.3Unauthenticated Privilege Escalation
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP
≤2.1.5Update to 2.1.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Docs
≤2.3.3Update to 2.3.4
- High7.2Authenticated (Admin+) Arbitrary File Upload
Rara One Click Demo Import
≤1.3.4Update to 1.3.5
- Medium4.3Missing Authorization
Advanced Customized Prompts
≤1.0.1No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Teddy Bear Customize Addon
≤1.0.5No patch available
- Medium6.5Authenticated (Import_contacts+) Path Traversal
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.7.1Update to 4.7.2
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Visualizer – Tables & Charts Manager with Built-in AI Generator
<4.0.6Update to 4.0.6
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Simple CAPTCHA with Cloudflare Turnstile
≤1.42.1Update to 1.42.3
- Medium6.43.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Sina Extension for Elementor
3.7.1 – 3.10.3Update to 3.10.4
- Medium5.3Unauthenticated Information Exposure
ZHBackup – Backup, Restore & Migration
≤2.4.2Update to 2.4.3
- Medium5.3Missing Authorization
Shirt Product Designer for WooCommerce
1.0.4 – 1.0.4No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion
Advanced Product Fields Extended for WooCommerce
≤3.1.6Update to 3.1.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Advanced Customized Prompts
≤1.0.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Translate WordPress with GTranslate
<3.0.10Update to 3.0.10
- High8.8Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
WP Plugin Hostgator
≤3.2.0Update to 3.2.1
- High8.8Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
YITH WooCommerce Waitlist Premium
≤3.35.0Update to 3.36.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤3.2.4Update to 3.2.5
- Medium6.5Authenticated (Administrator+) SQL Injection via 'feed' Parameter
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping
≤2.23.7Update to 2.23.8
- High7.2Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
≤2.50.0Update to 2.50.1