Database
WordPress Vulnerability Database (page 149)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.1Unauthenticated Arbitrary File Deletion
Shared Files – File Upload & Download Manager
<1.7.67Update to 1.7.67
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Login, Social Sharing by miniOrange
≤7.8.2Update to 7.9.0
- High7.32.12.1 - Unauthenticated Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
2.6.7 – 2.12.1Update to 2.13.0
- High7.23.19.16 - Unauthenticated Stored Cross-Site Scripting
12 Step Meeting List
3.17 – 3.19.16Update to 3.19.17
- High7.5Unauthenticated SQL Injection
Throws SPAM Away
≤3.8.2Update to 3.9
- Medium4.7Authenticated (Editor+) Privilege Escalation
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
<4.1.18Update to 4.1.18
- High8.8Authenticated (Author+) Remote Code Execution
Pods – Custom Content Types and Fields
<3.3.9.1Update to 3.3.9.1
- High7.5Unauthenticated Arbitrary Document Download
Document Embedder – let visitors read files without downloading
<2.3.1Update to 2.3.1
- Medium5.3Missing Authorization
Simple Payment
≤2.5.2Update to 2.5.3
- Critical9.81.0.48 - Backdoor
Newspapers X
1.0.46 – 1.0.48Update to 1.0.49
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<11.2.4Update to 11.2.4
- Medium5.33.7.1 - Missing Authorization to Unauthenticated Arbitrary AI Query Execution
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
3.4.0 – 3.7.1Update to 3.7.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Slider Hero with Video Background, Animation
<9.1.3Update to 9.1.3
- High7.2Unauthenticated Server-Side Request Forgery
Animation Addons – Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates
<2.7.2Update to 2.7.2
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
<5.2.6Update to 5.2.6
- Critical9.8Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
WPMU DEV Dashboard
≤5.0.1Update to 5.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
Avada (Fusion) Builder
≤3.15.6Update to 3.16
- Medium6.5Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
Tutor LMS – eLearning and online course solution
≤4.0.5Update to 4.0.6
- High7.5Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter
One User Avatar | User Profile Picture
≤2.5.4Update to 2.5.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
LiteSpeed Cache
≤7.8.1Update to 7.9
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes
LiteSpeed Cache
≤7.7Update to 7.8
- High7.2Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.0.1Update to 1.57.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.3Update to 3.3.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.10Update to 4.2.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
Smart Slider 3
≤3.5.1.38Update to 3.5.1.39
- High7.3Unauthenticated Privilege Escalation
RestrictMate – Restrict Page, Post and any Content ( Content Restriction and Membership Plugin)
<1.3.0Update to 1.3.0
- Medium4.3Authenticated (Subscriber+) Membership Plan Deletion
ACF Frontend Admin by DynamiApps
<3.29.11Update to 3.29.11
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
MW WP Form
<5.1.5Update to 5.1.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.12.4Update to 1.12.5
- High7.2Authenticated (Administrator+) Remote Code Execution
Defender Security – Malware Scanner, Login Security & Firewall
<6.2.0Update to 6.2.0