Database
WordPress Vulnerability Database (page 137)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Missing Authorization to Unauthenticated Stripe Credentials Update
Event Tickets and Registration
≤5.27.4Update to 5.27.4.1
- Medium5.3Unauthenticated Information Exposure
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Anti-Spam, Spam FireWall by CleanTalk
<6.87Update to 6.87
- High8.8Authenticated (Subscriber+) Arbitrary Account Email Takeover
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
<4.6.3Update to 4.6.3
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.1Update to 12.0.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.1Update to 12.0.2
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.1Update to 12.0.2
- Medium5.4Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
Flamingo
≤2.6.2Update to 2.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
Powerkit – Supercharge your WordPress Site
≤3.0.4Update to 3.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
<5.9.9Update to 5.9.9
- Medium5.3Missing Authorization to Unauthenticated Purchase Verification Bypass
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
≤3.1.7Update to 3.1.8
- High7.2Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.15.7Update to 3.15.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.2.0Update to 2.2.1
- High7.5Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
HivePress Authentication
≤1.1.4Update to 1.1.5
- Critical9.8Unauthenticated Account Takeover via '_acf_objects' Object Identifier
ACF Frontend Admin by DynamiApps
≤3.29.12Update to 3.29.13
- Critical9.8Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
MemberDash
≤1.8.5Update to 1.8.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
<5.9.8Update to 5.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Greenshift – animation and page builder blocks
<13.2.0Update to 13.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
VikWidgetsLoader – Collection of Widgets
<1.12.0Update to 1.12.0
- Medium4.3Authenticated (Contributor+) Information Exposure
The Events Calendar
<6.17.3.1Update to 6.17.3.1
- Medium4.96.2.5 - Authenticated (Editor+) SQL Injection
Kirki – Freeform Page Builder, Website Builder & Customizer
6.0.0 – 6.2.5Update to 6.3.0
- Medium4.36.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
Kirki – Freeform Page Builder, Website Builder & Customizer
6.0.0 – 6.2.5Update to 6.3.0
- Medium4.3Missing Authorization
Search Atlas SEO – OTTO AI SEO Automation for WordPress
<2.6.24Update to 2.6.24
- Medium5.3Unauthenticated Information Exposure
My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam
<4.2.3Update to 4.2.3
- Medium6.5Authenticated (Contributor+) Path Traversal
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.21Update to 4.1.21
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Greenshift – animation and page builder blocks
<13.2.0Update to 13.2.0
- Medium4.95.0.0 - Authenticated (Administrator+) Path Traversal
JCH Optimize
4.2.1 – 5.0.0Update to 5.0.1
- Medium6.42.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
1.18.0 – 2.3.3Update to 3.4.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
CatFolders Document Gallery & PDF Library
<2.0.7Update to 2.0.7
- Medium6.616.1.2 - Authenticated (Administrator+) PHP Object Injection
Jetpack – AI Agents & MCP, Security, Backup & Analytics
16.1 – 16.1.2Update to 16.1.3