Database
WordPress Vulnerability Database (page 150)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint
WP Rocket
≤3.21.0.1Update to 3.21.1
- High8.8Authenticated (Author+) Remote Code Execution
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.276Update to 1.0.277
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.9Update to 2.6.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
<8.5.5Update to 8.5.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Uncode
≤2.12.7Update to 2.12.8
- Medium5.3Missing Authorization to Unauthenticated Settings Change
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
<4.1.18Update to 4.1.18
- High7.2Authenticated (Administrator+) Remote Code Execution
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
<4.3.2Update to 4.3.2
- Medium5.3Insufficient Authorization
Newsletters
<4.17Update to 4.17
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Completion
MStore API – Create Native Android & iOS Apps On The Cloud
<4.21.1Update to 4.21.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
Finale Lite – Sales Countdown Timer & Discount for WooCommerce
<2.21.0Update to 2.21.0
- Medium4.3Cross-Site Request Forgery
Real Estate Papi
≤1.0.5No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Workeera – AI Job Board with Applicant Tracking System (ATS)
<1.0.6Update to 1.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.14.2Update to 3.8.14.3
- High7.5Unauthenticated Arbitrary File Read
爱采集数据采集和发布插件
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery
UpdraftPlus Premium
<1.26.7Update to 1.26.7
- Medium6.53.7.1 - Authenticated (Subscriber+) Arbitrary File Read
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
3.3.3 – 3.7.1Update to 3.7.2
- Medium5.3Unauthenticated Captcha Bypass
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.0Update to 6.8.1
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
Workeera – AI Job Board with Applicant Tracking System (ATS)
<1.0.6Update to 1.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
Booking for Appointments and Events Calendar – Amelia
≤2.2Update to 2.2.1
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 's' Parameter
ElementsKit Pro
≤4.10.1Update to 4.10.2
- High7.5Unauthenticated Denial of Service
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤4.2.0Update to 4.3.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist
<3.1.4Update to 3.1.4
- Medium4.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.5.0Update to 5.6.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
≤0.4.62Update to 0.4.63
- Medium4.3Missing Authorization
Advanced Custom Fields: Extended
≤0.9.2.6Update to 0.9.2.7
- High7.5Unauthenticated SQL Injection via 'referer' Parameter
wpForo Forum
≤2.4.17Update to 3.0.0
- High7.2Unauthenticated Open Redirect
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.43Update to 3.7.43
- High7.3Missing Authorization to Unauthenticated Settings Update
HEL Online Classroom: AI-powered Online Classrooms
≤1.0.3No patch available
- Medium5.3Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.4.4Update to 3.4.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.9.33Update to 5.9.34