Database
WordPress Vulnerability Database (page 145)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.12.1Update to 1.8.12.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.8.1Update to 4.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- High8.8Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
≤1.4.52Update to 1.4.53
- Medium4.9Authenticated (Administrator+) SQL Injection via 'product_order' Parameter
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.2Update to 5.9.3
- Medium5.3Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.17Update to 2.2.18
- High7.2Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function
Affiliate Super Assistent
≤1.10.2Update to 1.10.3
- Medium4.9Authenticated (Administrator+) SQL Injection via 's' Parameter
Photo Gallery by Ays – Responsive Image Gallery
≤6.8.2Update to 6.8.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie
Persistent Login
≤3.1.0Update to 3.1.1
- High7.2Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.1.9Update to 3.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- High7.2Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤5.8.1Update to 5.9.0
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.4Update to 4.4.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
ACF Frontend Admin by DynamiApps
≤3.29.11Update to 3.29.12
- High7.5Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
ACF Frontend Admin by DynamiApps
≤3.29.12Update to 3.29.13
- Critical9.8Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.12.1Update to 1.8.12.2
- High7.2Unauthenticated Stored Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Barcode Generator: Print Product and Order Labels with Barcodes (A4, Thermal/Roll, Letter)
≤4.0.0Update to 4.0.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Kalles Addons
≤1.0.6No patch available
- High7.2Unauthenticated Server-Side Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.15.0Update to 8.16.0
- Medium5.3Missing Authorization to Unauthenticated Unpublished Site Builder Content Disclosure
Solace Extra
<1.7.0Update to 1.7.0
- High7.5Authenticated (Subscriber+) PHP Object Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.10Update to 4.3.11
- High7.3Unauthenticated Privilege Escalation
Uix UserCenter
≤1.0.3No patch available
- Medium4.3Cross-Site Request Forgery
JetStyleManager for Gutenberg
<1.3.9Update to 1.3.9
- Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Post/User Meta Overwrite
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- High7.3Unauthenticated Privilege Escalation
MemberHero – Simple User Registration & Login
≤6.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.2Update to 3.8.3