Database
WordPress Vulnerability Database (page 142)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
RentSyst – CRM solution for fleet management
≤2.1.3No patch available
- Low3.13.15.1 - Authenticated (Custom Role+) Information Exposure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
3.14.0 – 3.15.1Update to 3.15.2
- High7.5Unauthenticated Denial of Service
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤10.1.08Update to 10.1.09
- Medium5.3Unauthenticated Price Manipulation
E-cab Taxi Booking Manager for Woocommerce
<2.0.5Update to 2.0.5
- Medium4.3Cross-Site Request Forgery
Simply Schedule Appointments
≤1.6.12.23Update to 1.6.12.24
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium4.3Cross-Site Request Forgery
Activity Log – Monitor User and Agent Changes
≤2.13.1Update to 2.14.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Estatik Real Estate Plugin
≤4.3.4No patch available
- High7.2Authenticated (Administrator+) Arbitrary File Upload
WPvivid — Backup, Migration & Staging
<0.9.134Update to 0.9.134
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.11Update to 14.16.12
- Medium5.3Unauthenticated Information Exposure
FormLayer
<1.0.9Update to 1.0.9
- Medium5.3Unauthenticated Information Exposure
Xpro Addons — 150+ Widgets for Elementor
<1.7.8Update to 1.7.8
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.0Update to 6.1.1
- Medium5.3Unauthenticated Information Exposure
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium5.3Missing Authorization
Ultimate Gift Cards for WooCommerce
≤3.2.9Update to 3.2.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Social Media Share Buttons & Social Sharing Icons
<3.0.1Update to 3.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Payment
≤2.5.1Update to 2.5.2
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
Broken Link Checker
≤2.4.14Update to 2.4.14.1
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
<2.7.2.1Update to 2.7.2.1
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium5.3Unauthenticated Two-Factor Authentication Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.0Update to 9.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
TrustedSite
≤1.2.5Update to 1.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP QuickLaTeX
≤3.8.8No patch available
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.3Update to 6.1.5
- High7.5Authenticated (Contributor+) PHP Object Injection
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.1.5Update to 2.1.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Bricksforge
≤3.1.8.8Update to 3.1.8.9
- High8.2Unauthenticated Path Traversal
ACF Frontend Admin by DynamiApps
≤3.29.12Update to 3.29.13
- Medium5.3Unauthenticated Payment Bypass
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.3Update to 4.5.4
- Medium4.3Cross-Site Request Forgery
Grand Tour | Travel Agency WordPress
≤5.5.1No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Graphene
≤2.9.4Update to 2.9.6