Database
WordPress Vulnerability Database (page 146)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Payment Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium5.3Missing Authorization
bbPress
≤2.6.14Update to 2.6.15
- High8.8Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting
FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]
≤8.0.1Update to 8.0.2
- Medium5.3Unauthenticated Password-Protected Post Content Disclosure
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277.1Update to 1.0.277.1
- High7.5Unauthenticated SQL Injection
Rest Routes – Custom Endpoints for WordPress REST API
≤5.5.5No patch available
- High8.1Unauthenticated Arbitrary Plugin Installation via Brute Force
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.1Update to 4.17.2
- Critical9.8Unauthenticated Arbitrary File Upload
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode
WP Recipe Maker Premium
≤10.5.0Update to 10.6.0
- Medium5.35.0.14 - Unauthenticated Information Exposure
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
5.0.13 – 5.0.14Update to 5.0.15
- Medium5.3Missing Authorization
Breakdance
≤2.8.1Update to 2.8.2
- High7.3Unauthenticated Arbitrary User Account Takeover
OAuth Single Sign On – SSO (OAuth Client)
≤7.0.0Update to 7.0.1
- Critical9.8Unauthenticated Privilege Escalation via Administrator Account Takeover
Advanced Custom Fields: Extended
<0.9.2.7Update to 0.9.2.7
- Medium4.9Authenticated (Admin+) Denial of Service
Kubio AI Page Builder
<2.9.1Update to 2.9.1
- High7.2Unauthenticated Server-Side Request Forgery
Total processing card payments for WooCommerce
≤7.3No patch available
- Medium5.3Unauthenticated Information Exposure
HEL Online Classroom: AI-powered Online Classrooms
≤1.0.3No patch available
- Medium5.3Missing Authorization
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<4.0.1Update to 4.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Customer Reviews for WooCommerce
<5.118.0Update to 5.118.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
≤0.8.7Update to 0.8.8
- Medium5.3Unauthenticated Payment Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
<2.4.9Update to 2.4.9
- Medium4.3Authenticated (Subscriber+) Password-Protected Post Password Disclosure
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor
<4.0.6Update to 4.0.6
- Medium5.36.1.1 - Missing Authorization
Oxygen
6.0 – 6.1.1Update to 6.1.2
- High8.8Authenticated (Custom Role+) Remote Code Execution
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
<9.8.0Update to 9.8.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Groundhogg — CRM, Newsletters, and Marketing Automation
<4.5.13Update to 4.5.13
- Medium5.6Unauthenticated Sensitive Information Exposure
Keep Backup Daily
≤2.1.3Update to 2.1.4
- Medium5.3Unauthenticated Email Content Injection
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
<6.1.3Update to 6.1.3
- Medium5.3Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding
Simple Membership
≤4.8.1Update to 4.8.2
- Medium5.3Unauthenticated Content Protection Bypass
Restrict User Access – Ultimate Membership & Content Protection
≤2.8Update to 2.8.1
- Medium5.3Missing Authorization to Unauthenticated Post Creation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.10Update to 4.3.11
- Medium5.3Unauthenticated Unpublished Course Data Exposure
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46