Database
WordPress Vulnerability Database (page 153)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Insecure Direct Object Reference to Data Access
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.68Update to 5.5.69
- High7.2Unauthenticated Stored Cross-Site Scripting
WP w3all phpBB
≤3.0.6Update to 3.0.7
- Medium5.3Unauthenticated Information Exposure
FiboSearch – Ajax Search for WooCommerce
<1.34.1Update to 1.34.1
- High7.2Hotel Booking WordPress Theme <= 1.10.0 - Unauthenticated Stored Cross-Site Scripting
CozyStay - Hotel Booking WordPress Theme
≤1.10.0Update to 1.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Music Player for WooCommerce
≤1.8.9Update to 1.9.0
- Medium4.93.1.23.3 - Authenticated (Admin+) Backup Download
JetBackup – Backup, Restore & Migrate
3.1.18.8 – 3.1.23.3Update to 3.1.23.5
- High8.8Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
Mang Board
≤2.3.7Update to 2.3.8
- High7.5Authenticated (Contributor+) PHP Object Injection
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.7.5Update to 2.7.6
- Medium6.5Authenticated (Subscriber+) SQL Injection
Like Button Rating ♥ LikeBtn
≤2.6.61Update to 2.6.62
- High7.2Authenticated (Editor+) Privilege Escalation
FluentCRM PRO
≤3.1.12Update to 3.1.13
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
<4.1.18Update to 4.1.18
- High8.1Unauthenticated PHP Object Injection
Geo Controller – Geolocation & Geotargeting
≤8.9.8Update to 8.9.9
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
Workeera – AI Job Board with Applicant Tracking System (ATS)
<1.0.6Update to 1.0.6
- High8.1Unauthenticated PHP Object Injection
Hash Form – Drag & Drop Form Builder
≤1.4.1Update to 1.4.2
- Medium5.3Unauthenticated Information Exposure
LearnPress – Sepay Payment
<4.0.3Update to 4.0.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.12.1Update to 2.13.0
- Medium4.9Authenticated (Administrator+) SQL Injection via 'fields' Parameter
Media Sweep – WordPress Media Cleaner
≤1.1.3Update to 1.1.4
- Medium5.3Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools
≤3.3.6Update to 3.3.7
- Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
Newsletters
≤4.17Update to 4.18
- High7.2Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets
≤4.9.4Update to 4.9.5
- High8.8Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
All-in-One WP Migration and Backup
≤7.109Update to 7.110
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
eCommerce Product Catalog
≤3.5.10Update to 3.5.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.1.8Update to 4.1.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor
TranslatePress – Translate Multilingual sites with AI Translation
≤3.2.6Update to 3.3
- High7.2Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.0Update to 1.57.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.0.2Update to 1.57.0.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action
CM Map Locations – Visualize and share your locations in a few clicks
≤2.1.8Update to 2.1.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
tagDiv Composer
≤5.4.7Update to 5.4.8
- High8.8Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
InfusedWoo Pro
≤5.1.17Update to 5.1.18
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤4.0.2Update to 4.0.3