Database
WordPress Vulnerability Database (page 147)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Unapproved Comment and Private Profile Data Disclosure
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.13.0Update to 2.13.0
- Medium5.3Unauthenticated Limited File Upload
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.16.1Update to 3.16.2
- High7.2Authenticated (Administrator+) Remote Code Execution
WPvivid — Backup, Migration & Staging
<0.9.133Update to 0.9.133
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SOGO Add Script to Individual Pages Header Footer
≤3.9No patch available
- Critical9.8Authentication Bypass to Account Takeover via Activation Token
MyHome Core
≤4.4.5Update to 4.4.6
- Critical9.8Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
Custom User Registration Fields for WooCommerce
≤2.2.3Update to 2.2.4
- High7.5Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
SAML Single Sign On – SSO Login
≤5.4.6Update to 5.4.7
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
SmartAIPress
≤1.2.0No patch available
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.42Update to 3.7.42
- Medium6.6Authenticated (Administrator+) PHP Object Injection
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<4.0.1Update to 4.0.1
- Medium4.3Cross-Site Request Forgery
Newsletters
<4.17Update to 4.17
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
<9.0Update to 9.0
- Medium5.3Unauthenticated Information Exposure
HEL Online Classroom: AI-powered Online Classrooms
≤1.0.3No patch available
- Medium5.3Missing Authorization
Catfolders Document Gallery Pro
<2.0.7Update to 2.0.7
- Low2.7Missing Authorization
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- Medium4.32.4.8 - Missing Authorization
Booking for Appointments and Events Calendar – Amelia
1.2.32 – 2.4.8Update to 2.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<4.0.1Update to 4.0.1
- High7.31.6.2 - Unauthenticated Booking Price Manipulation
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
1.5.6 – 1.6.2Update to 1.6.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Tailored Tools
≤3.0.2Update to 3.0.3
- Medium6.1Reflected Cross-Site Scripting
GeotargetingWP
<3.5.6.2Update to 3.5.6.2
- Medium5.3Unauthenticated Information Exposure
KiviCare – Clinic & Patient Management System (EHR)
≤4.5.4Update to 4.5.5
- Medium5.3Unauthenticated Information Exposure
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
<4.3.10Update to 4.3.10
- Medium4.3Missing Authorization
OwnerRez
≤1.2.6Update to 1.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Super Store Finder
≤7.10Update to 7.11
- High7.5Unauthenticated SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.81Update to 5.5.82
- High7.2Unauthenticated Stored Cross-Site Scripting
Email Essentials
≤6.0.6Update to 6.0.7
- High7.3Unauthenticated Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<4.17.1Update to 4.17.1
- High7.5Unauthenticated SQL Injection
Smart Marketing SMS and Newsletters Forms
≤5.1.24Update to 5.1.25
- High7.3Unauthenticated Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.57.1Update to 1.57.1
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.57.0.7Update to 1.57.0.7