Database
WordPress Vulnerability Database (page 135)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.3Update to 12.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Page Visits Counter – Lite
≤1.2.3Update to 2.0.0
- Medium5.3Unauthenticated Unauthorized Lead and Search Manipulation
IMPress for IDX Broker
≤3.3.0Update to 3.3.1
- Medium5.3Missing Authorization
Thanko Thank You Page Customizer for WooCommerce
≤1.2.2Update to 1.2.3
- High8.1Unauthenticated PHP Object Injection
Wise Chat
≤3.4.2Update to 3.4.3
- Medium4.3Missing Authorization
MailMunch – Grow your Email List
≤3.3.0Update to 3.3.1
- Medium5.36.3.0 - Unauthenticated Second Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤19.2Update to 19.3 or 6.3.1
- Medium6.1Unauthenticated Arbitrary Shortcode Execution
Simple CAPTCHA with Cloudflare Turnstile
≤1.42.1Update to 1.42.3
- Medium5.3Unauthenticated Inflated Gift Card Credit Acquisition
Ultimate Gift Cards for WooCommerce
<3.2.10Update to 3.2.10
- High7.26.2.5 - Unauthenticated Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer
6.2.1 – 6.2.5Update to 6.3.0
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.5No patch available
- Medium4.3Missing Authorization
IMPress for IDX Broker
≤3.3.0Update to 3.3.1
- Medium5.3Unauthorized WordPress Account Creation
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
<4.7.0Update to 4.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CoolClock
≤4.3.7Update to 4.3.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
EventON – Events Calendar
≤2.5.7Update to 2.5.8
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.3.7No patch available
- High7.36.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤19.2Update to 19.3 or 6.3.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting
Graphina – Charts and Graphs For Elementor
≤3.1.11Update to 3.1.12
- High7.3Unauthenticated Privilege Escalation
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
≤6.1.5Update to 6.1.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.6.0Update to 5.6.4
- Medium5.3Missing Authorization
Hungarian Pickup Points & Shipping Labels for WooCommerce
<4.2.8Update to 4.2.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Open User Map – Interactive Leaflet Maps
≤1.4.50Update to 1.4.51
- Medium4.3Missing Authorization
Unbounce Landing Pages
≤1.1.4Update to 1.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.1Update to 3.6.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Appointments
≤4.0.2.1No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Hide My WP Ghost – Security & Firewall
≤7.0.09Update to 7.0.10
- High7.5Unauthenticated Denial of Service
WooCommerce
<11.1.0Update to 11.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.17Update to 2.0.18
- High7.5Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter
WP Fusion (Pro)
≤3.47.13Update to 3.47.14
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.9.27Update to 5.9.28