Database
WordPress Vulnerability Database (page 154)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter
FundEngine – Donation and Crowdfunding Platform
≤1.8.1Update to 1.8.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
FundEngine – Donation and Crowdfunding Platform
≤1.8.1Update to 1.8.2
- Medium6.1Reflected Cross-Site Scripting via 'header_format' Parameter
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.0.1Update to 7.4.1
- Medium6.6Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.3.7.4Update to 7.4
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.0Update to 7.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PPWP – Password Protect Pages
≤1.9.21Update to 1.9.22
- Medium4.4Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.4Update to 4.4.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.16Update to 2.2.17
- Medium4.3Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤3.2.29Update to 3.2.30
- High8.1Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter
FluentCart – Online Store Builder & eCommerce Checkout
≤1.6.2Update to 1.6.3
- Medium6.5Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.0Update to 7.4.1
- High8.1Unauthenticated PHP Object Injection
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
≤4.0.6Update to 4.0.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action
BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
≤3.1.0Update to 3.1.1
- Medium4.3Missing Authorization
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤5.8.3Update to 5.8.4
- Medium5.3Unauthenticated Information Exposure
Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads
≤1.2.0Update to 1.2.1
- Medium4.3Missing Authorization
Style Kits for Elementor
≤2.6.5Update to 2.6.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Accept Stripe Payments
≤2.1.2Update to 2.1.3
- High7.3Unauthenticated Privilege Escalation
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.2Update to 3.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Event Tickets and Registration
≤5.29.2.1Update to 5.29.3
- High8.1Unauthenticated PHP Object Injection
The Events Calendar
≤6.17.2Update to 6.17.3
- High7.5Authenticated (Subscriber+) PHP Object Injection
ACPT (Premium)
≤2.0.63No patch available
- Medium6.3AI-Powered Scheduling, Reservation and Appointment System for WordPress <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation
Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress
≤1.3.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Boost
≤2.0.4No patch available
- High7.5Unauthenticated SQL Injection
Boost
≤2.0.4No patch available
- High7.5Unauthenticated SQL Injection
WooCommerce Product Filter
≤3.1.8No patch available
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
FluentCRM PRO
≤3.1.12Update to 3.1.13
- High7.2Unauthenticated Stored Cross-Site Scripting
Brave Conversion Engine (PRO)
≤0.8.6Update to 0.8.7
- High7.5Unauthenticated Arbitrary File Read
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- High7.3Unauthenticated Privilege Escalation
WordPress & WooCommerce Affiliate Program
≤8.9.1No patch available
- Medium6.5Authenticated (Author+) SQL Injection
FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
≤3.1.12Update to 3.1.13