Database
WordPress Vulnerability Database (page 148)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.39.7 - Authenticated (Provider+) Arbitrary Provider Password Update
Booking for Appointments and Events Calendar – Amelia
9.0 – 9.7Update to 9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Spiffy Calendar
≤5.0.8Update to 5.0.9
- High8.1Unauthenticated PHP Object Injection
Tickera – Sell Tickets & Manage Events
≤3.6.0.2Update to 3.6.0.3
- Medium6.6Authenticated (Editor+) PHP Object Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
<4.3.10Update to 4.3.10
- High7.2Authenticated (Shop Manager+) Remote Code Execution
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
<5.0.14Update to 5.0.14
- Medium4.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.7.6Update to 2.7.7
- Medium5.3Unauthenticated Arbitrary Price Manipulation
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
<2.1.2Update to 2.1.2
- Medium5.3Missing Authorization
Fluent Forms Pro Add On Pack
≤6.2.12Update to 6.2.13
- Medium5.3Unauthenticated Information Exposure
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages
<3.7.1Update to 3.7.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
MW WP Form
<5.1.6Update to 5.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliate Program Suite — SliceWP Affiliates
≤1.2.10Update to 1.2.11
- Medium6.5Authenticated (Contributor+) SQL Injection
WPBulky – WordPress Bulk Edit Post Types
≤1.2.2Update to 1.2.3
- Critical9.8Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field
SigmaForms Pro – AI Generated Forms
≤1.4.5Update to 1.4.6
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.7.1Update to 4.16.7.2
- Medium5.3Unauthenticated Information Exposure
WP OAuth Server ( Login with WordPress )
<6.3.1Update to 6.3.1
- Medium6.1Reflected Cross-Site Scripting
Tangible: Loops & Logic
≤4.3.1No patch available
- Medium5.32-Factor Authentication Bypass
Security Optimizer – The All-In-One Protection Plugin
≤1.6.6Update to 1.6.7
- Critical9.8Unauthenticated Arbitrary File Upload
Hash Form – Drag & Drop Form Builder
≤1.4.2Update to 1.4.3
- High7.2Unauthenticated Stored Cross-Site Scripting
LeadConnector
≤4.0.5Update to 4.0.6
- Medium5.3Unauthenticated File Creation via Path Traversal
Breeze Cache
<2.5.13Update to 2.5.13
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
<5.2.5Update to 5.2.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist
≤1.7.1Update to 1.7.2
- High7.3Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium4.31.8.5.4 - Missing Authorization
Content Mask
1.8.0 – 1.8.5.4Update to 1.8.5.5
- Medium4.38.9.2 - Authenticated (Subscriber+) Arbitrary Image Move
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.5 – 8.9.2Update to 8.9.3
- Medium5.3Unauthenticated Payment Bypass
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.1Update to 1.57.2
- Medium6.5Authenticated (Custom Role+) Arbitrary File Read
Tutor LMS – eLearning and online course solution
<4.0.6Update to 4.0.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Fluent Forms Pro Add On Pack
≤6.2.12Update to 6.2.13
- Medium5.3Missing Authorization
Return Refund and Exchange For WooCommerce
<4.6.4Update to 4.6.4
- Medium5.33.23.3.2 - Unauthenticated Information Exposure
WP Rocket
3.23.1 – 3.23.3.2Update to 3.23.3.3