Database
WordPress Vulnerability Database (page 151)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
All-in-One WP Migration Unlimited Extension
≤2.84Update to 2.85
- High7.2Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form
Customer Reviews for WooCommerce
≤5.106.0Update to 5.107.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
GiveWP – Donation Plugin and Fundraising Platform
≤4.14.4Update to 4.14.5
- Medium6.3Missing Authorization
MStore API – Create Native Android & iOS Apps On The Cloud
<4.21.1Update to 4.21.1
- Medium5.3Unauthenticated Payment Bypass
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.40Update to 3.7.40
- Medium4.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.5.0Update to 5.6.0
- High7.2Authenticated (Administrator+) Remote Code Execution
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.57.0.5Update to 1.57.0.5
- High7.5Unauthenticated Arbitrary File Read via 'frm_graph' Parameter
Formidable Charts
≤2.0.1Update to 2.0.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
<4.0.7Update to 4.0.7
- Medium5.3Unauthenticated Limited File Upload
Shared Files – File Upload & Download Manager
<1.7.67Update to 1.7.67
- Medium5.3Unauthenticated Information Exposure
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.22Update to 4.1.22
- Critical9.8Unauthenticated Arbitrary Zero-Argument Function Invocation
Tutor LMS – eLearning and online course solution
≤4.0.5Update to 4.0.6
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference
Timetics – Appointment Booking Calendar & Scheduling
<1.0.62Update to 1.0.62
- Medium5.3Missing Authorization
Kirki – Freeform Page Builder, Website Builder & Customizer
<6.0.14Update to 6.0.14
- Medium4.34.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
2.2.0 – 4.0.6Update to 4.0.7
- Medium6.5Authenticated (Contributor+) SQL Injection
Suggestion Engine for WooCommerce
≤2.0.11Update to 2.0.12
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
<2.4.7Update to 2.4.7
- High7.2Authenticated (Editor+) Arbitrary File Upload
Fluent Boards Pro
≤2.0.11Update to 2.0.12
- Medium6.5Authenticated (Editor+) Arbitrary File Deletion
Fluent Boards Pro
≤2.0.11Update to 2.0.12
- Medium4.9Authenticated (Administrator+) SQL Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<6.0.9.4Update to 6.0.9.4
- Low2.7Missing Authorization
Fluent Player Pro
≤1.3.2Update to 1.4.0
- Medium5.3Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.23Update to 2.4.24
- Medium4.3Missing Authorization
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.67Update to 3.1.69
- Medium4.3Cross-Site Request Forgery
Fluent Booking Pro
≤2.2.4Update to 2.2.5
- Medium4.3Cross-Site Request Forgery
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.176Update to 2.8.177
- Medium4.3Authenticated (Subscriber+) Information Exposure
SureFeedback Client Site
≤1.2.12Update to 1.2.13
- Medium5.3Missing Authorization
Noptin – Newsletter, New Post Notifications & Email Automation
<4.3.3Update to 4.3.3
- Critical9.8Authentication Bypass to Administrator
SmilePass Selfie Login
≤1.0.2No patch available
- Medium4.3Missing Authorization
Push Notification for Post and BuddyPress
≤3.20Update to 3.21
- Medium5.3Missing Authorization
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
<3.0.18Update to 3.0.18