Database
WordPress Vulnerability Database (page 139)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box
Social Chat – Click To Chat App Button
≤8.6.2Update to 8.6.3
- Critical9.8Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
≤3.21.0Update to 3.21.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
≤2.4.30Update to 2.4.37
- Medium4.9Authenticated (Administrator+) SQL Injection
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
<4.4.2Update to 4.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Woodmart
<8.3.8Update to 8.3.8
- Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<3.13.0Update to 3.13.0
- High7.2Authenticated (Administrator+) Remote Code Execution
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
<3.21.2Update to 3.21.2
- Medium4.9Authenticated (Shop Manager+) SQL Injection
WooCommerce
≤10.9.4Update to 11.0
- Medium5.45.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
LearnDash LMS
4.25.0 – 5.1.6Update to 5.1.6.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
<8.9Update to 8.9
- Critical9.8Unauthenticated PHP Object Injection in Arbitrary Form Fields
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.0Update to 1.31.1
- Medium5.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.11.11Update to 2.12.0
- Medium6.4Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
Ninja Forms - Scheduled Exports
≤3.0.3Update to 3.0.4
- Medium5.3Unauthenticated Information Exposure
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<3.13.0Update to 3.13.0
- Medium5.3Missing Authorization
Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)
<4.5.1.2Update to 4.5.1.2
- Medium5.3Unauthenticated Unauthorized B2B Group Assignment
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
<5.2.40Update to 5.2.40
- Medium6.53.3.9.1 - Authenticated (Author+) Arbitrary File Read
Pods – Custom Content Types and Fields
3.3 – 3.3.9.1Update to 3.3.9.2
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters
Custom Contact Forms
≤7.16Update to 7.16.1
- Medium5.4Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.3.3Update to 7.3.4
- Medium4.3Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
Ninja Forms - Save Progress
≤3.0.30Update to 3.0.31
- High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Abandoned Cart Pro for WooCommerce
≤10.7.1Update to 10.7.2
- Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<3.13.0Update to 3.13.0
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.60Update to 2.1.70
- High8.8Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
Nokri – Job Board WordPress Theme
≤1.6.4Update to 1.6.6
- Medium4.3Booking Accommodation WordPress Theme < 3.16.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
WP Rentals - Booking Accommodation WordPress Theme
<3.16.0Update to 3.16.0
- Medium5.3Missing Authorization
JetPopup
≤2.0.20.2Update to 2.0.20.3
- Medium6.53.15.1 - Unauthenticated Arbitrary Shortcode Execution
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
3.14.10 – 3.15.1Update to 3.15.2
- Critical9.8Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
Divi Ajax Filter
≤5.1.2Update to 5.1.3
- High8.1Unauthenticated PHP Object Injection
JobSearch WP Job Board
≤3.2.0No patch available
- High7.5Unauthenticated Arbitrary File Read
Shared Files Pro
<1.7.70Update to 1.7.70