Database
WordPress Vulnerability Database (page 152)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Fluent Boards Pro
≤2.0.11Update to 2.0.12
- Medium5.3Insecure Direct Object Reference to Unauthenticated Arbitrary Order Refund Request
WCFM Marketplace – Multivendor Marketplace for WooCommerce
<3.8.2Update to 3.8.2
- Medium6.11.5.0 - Unauthenticated Cache Poisoning
WP Fastest Cache – WordPress Cache Plugin
0.8.7.7 – 1.5.0Update to 1.5.1
- Medium6.6Authenticated (Editor+) PHP Object Injection
Fluent Boards Pro
≤2.0.11Update to 2.0.12
- Medium5.3Missing Authorization
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1066Update to 1.7.1066
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1066Update to 1.7.1066
- Medium6.3Missing Authorization to Authenticated (Subscriber+) Settings Change
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
4.0.0-beta.1 – 4.0.0-beta.1Update to 4.0.1
- High8.1Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
Classified Listing - Mobile Number Verification
≤1.6.0Update to 1.7.0
- Critical9.8Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.8Update to 1.17.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Reviews and Rating – Google Reviews
≤5.10Update to 6.0
- Critical9.8Unauthenticated Remote Code Execution via Arbitrary File Write
Avada (Fusion) Builder
≤3.16Update to 3.16.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.33.1Update to 6.34
- High7.2Unauthenticated Stored Cross-Site Scripting via HTTP Host Header
WP Fastest Cache – WordPress Cache Plugin
≤1.5.0Update to 1.5.1
- Critical9.8Unauthenticated Account Takeover via Password Reset Link Disclosure
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.1Update to 3.3.2
- High7.5Unauthenticated SQL Injection
Beautiful taxonomy filters
≤2.4.6Update to 2.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Realtyna Organic IDX plugin + WPL Real Estate
≤5.4.1Update to 5.4.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Stock Update
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
≤0.4.69No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI
Greenshift – animation and page builder blocks
≤12.8.9Update to 12.9.0
- High7.5Unauthenticated SQL Injection
Visitor Traffic Real Time Statistics pro
≤11.17Update to 11.18
- High7.2Unauthenticated Stored Cross-Site Scripting
CP Media Player – Audio Player and Video Player
≤1.3.0Update to 1.3.1
- Medium5.3Missing Authorization
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
≤0.4.62Update to 0.4.63
- Medium6.5Authenticated (Subscriber+) SQL Injection
ACPT (Premium)
≤2.0.63No patch available
- High7.5Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
WooCommerce Lottery
≤2.2.9Update to 2.2.10
- Critical9.8Authentication Bypass
ManageWP Worker
<4.9.37Update to 4.9.37
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤4.0.2Update to 4.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Fastest Cache – WordPress Cache Plugin
≤1.5.0Update to 1.5.1
- Critical9.8Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
ACPT (Premium)
≤2.0.66Update to 2.0.67
- High7.5Unauthenticated SQL Injection
ePayco plugin for WooCommerce
≤8.4.6Update to 8.4.7
- Medium6.5Authenticated (Subscriber+) SQL Injection
Kadence Shop Kit
≤3.0.6Update to 3.0.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
Betheme
≤28.4Update to 28.4.1