Database
WordPress Vulnerability Database (page 136)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
Music Store – WordPress eCommerce
<1.4.5Update to 1.4.5
- High7.1Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter
EDD Product Catalog Feed by PixelYourSite
≤1.0.2Update to 1.0.3
- High8.8Authenticated (Contributor+) PHP Object Injection via Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.18Update to 2.1.19
- Medium5.3Unauthenticated Payment Bypass
WP Express Checkout (Fast Payments via PayPal & Stripe)
≤2.4.0Update to 2.5.0
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter
Zephyr Project Manager
≤3.3.205Update to 3.3.206
- Medium6.5Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
WPML Multilingual CMS
≤4.9.5Update to 4.9.6
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.10.3.1Update to 2.10.3.2
- High7.5Unauthenticated SQL Injection
ELEX WooCommerce Request a Quote
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.9.1Update to 4.4.0
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
Online Scheduling and Appointment Booking System – Bookly
≤27.2Update to 27.3
- Medium5.33.5.2 - Unauthenticated Ticket Attachment Read
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
3.2.9 – 3.5.2Update to 3.5.3
- Medium4.3Missing Authorization
Ultimate Gift Cards for WooCommerce
≤3.2.9Update to 3.2.10
- Medium6.1Reflected Cross-Site Scripting
IPGP Visitors Origin
<1.6Update to 1.6
- Medium5.3Unauthenticated Information Exposure
Tangible: Loops & Logic
≤4.2.0Update to 4.3.0
- Medium4.9Authenticated (Administrator+) SQL Injection
Quentn WP
≤1.2.14Update to 1.2.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
≤3.0.8Update to 3.0.9
- Medium4.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium5.3Unauthenticated Information Exposure
Payment Plugins for PayPal WooCommerce
≤2.0.25Update to 2.0.26
- Medium4.34.4.1 - Missing Authorization to Information Exposure
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
4.0.2 – 4.4.1Update to 4.4.2
- Medium6.50.1.8 - Unauthenticated Arbitrary Shortcode Execution
LukasApps CAPTCHA tools for Contact Form 7
0.1.7 – 0.1.8Update to 0.1.9
- Medium5.3Unauthenticated Insecure Direct Object Reference
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.6Update to 3.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
HT Menu – WordPress Mega Menu Builder for Elementor
<1.2.7Update to 1.2.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JCH Optimize
<6.0.1Update to 6.0.1
- Medium4.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium5.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium6.1Unauthenticated Open Redirect
Groundhogg — CRM, Newsletters, and Marketing Automation
<4.7.2Update to 4.7.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Hustle – Email Marketing, Lead Generation, Optins, Popups
<7.8.14.2Update to 7.8.14.2
- Medium4.3Missing Authorization
Payment Plugins for PayPal WooCommerce
≤2.0.25Update to 2.0.26
- Medium5.3Unauthenticated Information Exposure
Payment Plugins for Stripe WooCommerce
≤4.0.11Update to 4.0.12
- High7.33.0.2 - Unauthenticated Privilege Escalation
SEO Flow by LupsOnline
3.0.0 – 3.0.2Update to 3.0.3