Database
WordPress Vulnerability Database (page 143)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- High7.2File Uploads <= 3.3.26 - Unauthenticated Stored Cross-Site Scripting
Ninja Forms - File Uploads
≤3.3.26No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculation for contact form 7
≤1.0Update to 1.1
- Medium4.9Authenticated (Administrator+) SQL Injection
WPvivid — Backup, Migration & Staging
<0.9.133Update to 0.9.133
- Medium5.3Unauthenticated Information Exposure
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- Medium5.3Unauthenticated Product Price Manipulation
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<3.13.0Update to 3.13.0
- Medium5.3Missing Authorization to Unauthenticated Settings Update
WP Compress – Instant Performance & Speed Optimization
≤7.21.28Update to 7.22.0
- High7.5Unauthenticated Denial of Service
Migrate Guru – Site Migration & Cloning
≤6.65Update to 6.72
- High7.5Unauthenticated SQL Injection
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.174Update to 2.8.175
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Choosly – Product Variations Swatches for WooCommerce
≤1.1.18Update to 1.1.19
- Medium5.3Unauthenticated Unauthorized Order Status Manipulation
ePayco plugin for WooCommerce
<8.4.7Update to 8.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Under Construction
≤5.82Update to 5.83
- Medium4.3Cross-Site Request Forgery
Mang Board
≤2.3.8Update to 2.3.9
- Medium4.3Authenticated (Author+) Information Exposure
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- High7.5Unauthenticated Denial of Service
MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
≤6.69Update to 6.72
- High7.2Unauthenticated Stored Cross-Site Scripting
Breadcrumb NavXT
≤7.5.1Update to 7.5.2
- Medium5.3Missing Authorization
YITH Request a Quote for WooCommerce (Premium)
<4.46.0Update to 4.46.0
- High7.2Unauthenticated Stored Cross-Site Scripting
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.1.5Update to 2.1.6
- Medium5.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ultimate Before After Image Slider & Gallery – BEAF
<4.7.19Update to 4.7.19
- High7.5Unauthenticated Denial of Service
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.0Update to 9.8.1
- Medium4.3Cross-Site Request Forgery
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
<2.7.2.1Update to 2.7.2.1
- High7.5Unauthenticated SQL Injection
Comments – wpDiscuz
<7.6.66Update to 7.6.66
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ultimate Before After Image Slider & Gallery – BEAF
<4.7.19Update to 4.7.19
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium5.3Unauthenticated Insecure Direct Object Reference
MotoPress Appointment Booking
<2.4.8Update to 2.4.8
- Medium5.3Unauthenticated Forged Payment Completion
Restaurant Menu and Food Ordering
<2.4.12Update to 2.4.12
- High7.2Unauthenticated Server-Side Request Forgery
LiteSpeed Cache
≤7.9Update to 7.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
Easy Waveform Player
≤1.2.2Update to 1.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
Broken Link Checker
≤2.4.13Update to 2.4.13.1