Database
WordPress Vulnerability Database (page 141)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.34.6.3 - Missing Authorization to Authenticated (Contributor+) Site-Wide Places Library Modification
EmbedPress
4.6.0 – 4.6.3Update to 4.6.4
- Medium5.3Missing Authorization to Unauthenticated JetEngine Options Page Modification
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.2Update to 3.6.2.1
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.5Update to 4.4.6
- Critical9.8Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium5.3Missing Authorization
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.5.3Update to 1.5.4
- Medium4.3Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
<7.9.9.6Update to 7.9.9.6
- Medium4.3Missing Authorization
Agentimus – AI SEO, llms.txt & MCP for AI Agents
≤1.51.0Update to 1.51.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Ajax Chat – Add a Fast, Secure Chat Box
<20260827Update to 20260827
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.8.44Update to 1.8.44
- High7.2Unauthenticated Stored Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<6.0.9.9Update to 6.0.9.9
- Medium5.34.0.7 - Unauthenticated Password-Protected Post Content Disclosure
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News
4.0.0 – 4.0.7Update to 4.0.8
- Medium5.3Missing Authorization
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.0Update to 1.31.1
- Medium6.4Authenticated (Instructor+) Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.5Update to 4.4.6
- Medium5.3Missing Authorization
Bookit — Booking & Appointment Calendar
≤2.6.0.3Update to 2.6.0.4
- Medium6.116.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤16.1.2Update to 14.5.1 or 14.6.1 or 14.7.1 or 14.8.1 or 14.9.2 or 15.0.3 or 15.1.2 or 15.2.1 or 15.3.2 or 15.4.1 or 15.5.1 or 15.6.1 or 15.7.2 or 15.8.1 or 15.9.2 or 16.0.2 or 16.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPKoi Templates for Elementor
≤3.7.2Update to 3.7.3
- High7.30.9.2.6 - Unauthenticated Privilege Escalation
Advanced Custom Fields: Extended
0.9.2.2 – 0.9.2.6Update to 0.9.2.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.7.7Update to 2.7.8
- High7.5Unauthenticated SQL Injection
VikAppointments Services Booking Calendar
≤1.2.20Update to 1.2.21
- Medium4.316.1.2 - Missing Authorization on WPCOM Media API Attachment Parent
Jetpack – AI Agents & MCP, Security, Backup & Analytics
3.2 – 16.1.2Update to 16.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
Divi
≤4.27.6Update to 4.27.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
≤2.4.4Update to 2.4.5
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
<2.7.2.1Update to 2.7.2.1
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
WPvivid — Backup, Migration & Staging
<0.9.134Update to 0.9.134
- Medium5.3Unauthenticated Insecure Direct Object Reference
PublishPress Permissions: Access Control, Content Permissions, User Access
≤4.8.3Update to 4.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.4Update to 1.3.5
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.11.11Update to 2.12.0
- Medium6.4Authenticated (Contributor +) Stored Cross-Site Scripting
SEO WRITING – AI Writer for SEO & AI Search
≤1.12.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.27Update to 2.15.28
- High7.2Unauthenticated Stored Cross-Site Scripting
EWWW Image Optimizer
≤8.7.6Update to 8.7.7