Database
WordPress Vulnerability Database (page 140)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Responsive Multi-Purpose Theme <= 8.0 - Unauthenticated Stored Cross-Site Scripting
enfold
≤8.0Update to 8.1
- Medium5.34.6.3 - Unauthenticated Paid API Consumption and Database Row Injection
EmbedPress
4.6.0 – 4.6.3Update to 4.6.4
- Medium5.3Unauthenticated Email Header Injection
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Critical9.8Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
SEOPress – AI SEO Plugin & On-site SEO
≤10.1Update to 10.2
- High8.1Unauthenticated PHP Object Injection
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.0Update to 1.31.1
- Medium5.3Missing Authorization
Pre-Orders for WooCommerce
≤2.3.1Update to 2.3.2
- Medium6.1Unauthenticated Open Redirect
Accept Stripe Payments
<2.1.4Update to 2.1.4
- High7.21.8.4 - Unauthenticated Stored Cross-Site Scripting
FAQ Builder AYS
1.6.3 – 1.8.4Update to 1.8.5
- Medium5.3Missing Authorization
Quick Event Manager
≤9.18Update to 9.19
- Medium5.3Missing Authorization
Timetics – Appointment Booking Calendar & Scheduling
≤1.0.61Update to 1.0.62
- Medium4.42.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Joli Table Of Contents – Table of Contents with Gutenberg Block & Shortcode
2.0.0 – 2.8.0Update to 2.8.1
- Medium5.3Missing Authorization
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.12.13Update to 3.13.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.5Update to 2.12.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Quick Event Manager
≤9.18Update to 9.19
- Medium6.53.2.10 - Unauthenticated Arbitrary Shortcode Execution
Redirection for Contact Form 7
2.2.7 – 3.2.10Update to 3.2.11
- Medium6.1Reflected Cross-Site Scripting
Social Media Share Buttons & Social Sharing Icons
<3.0.1Update to 3.0.1
- Medium5.3Missing Authorization
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.26Update to 6.4.27
- Medium6.37.1.15 - Authenticated (Subscriber+) Privilege Escalation
Theme My Login
7.0 – 7.1.15Update to 7.2.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- High7.216.1.2 - Authenticated (Administrator+) PHP Object Injection
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤16.1.2Update to 12.0.3 or 12.1.3 or 12.2.3 or 12.3.2 or 12.4.2 or 12.5.2 or 12.6.4 or 12.7.3 or 12.8.3 or 12.9.5 or 13.0.2 or 13.1.5 or 13.2.4 or 13.3.3 or 13.4.5 or 13.5.2 or 13.6.2 or 13.7.2 or 13.8.3 or 13.9.2 or 14.0.1 or 14.1.1 or 14.2.2 or 14.3.1 or 14.4.2 or 14.5.1 or 14.6.1 or 14.7.1 or 14.8.1 or 14.9.2 or 15.0.3 or 15.1.2 or 15.2.1 or 15.3.2 or 15.4.1 or 15.5.1 or 15.6.1 or 15.7.2 or 15.8.1 or 15.9.2 or 16.0.2 or 16.1.3
- Medium4.3Missing Authorization
MountDev AI MCP Connector for WordPress
≤1.6.5Update to 1.6.6
- Medium6.33.1.23.3 - Authenticated (Subscriber+) Privilege Escalation
JetBackup – Backup, Restore & Migrate
3.1.7.9 – 3.1.23.3Update to 3.1.23.5
- Medium5.3Missing Authorization
Fluent Booking Pro
≤2.2.1Update to 2.3.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.26Update to 6.4.27
- Medium4.3Missing Authorization to Authenticated (Author+) SEO Object Updates
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- Medium5.3Missing Authorization
Unlimited Elements for Elementor
≤2.0.17Update to 2.0.18
- Medium5.3Unauthenticated Information Exposure
KP Agent Ready
≤1.1.99Update to 1.2.08
- High7.5Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
LearnDash LMS
≤5.1.5Update to 5.1.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2