Database
WordPress Vulnerability Database (page 155)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Site Takeover via Brute Force
BlogVault Backup & Staging
<6.65Update to 6.65
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Shared Files – File Upload & Download Manager
≤1.7.69Update to 1.7.70
- High7.5AI Text, Image, Chat, Code, and Voice Generator <= 1.4 - Authenticated (Subscriber+) Local File Inclusion
MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator
≤1.4No patch available
- Medium5.3Unauthenticated Information Exposure
NewPath WildApricotPress Add-on – Member Directory
≤1.0.0No patch available
- High7.5Unauthenticated SQL Injection
Tutor LMS – eLearning and online course solution
<4.0.6Update to 4.0.6
- Medium4.3Missing Authorization
Fluent Support Pro
≤2.3.1Update to 2.3.2
- Critical9.1Unauthenticated Arbitrary File Deletion
Shopbuilder Pro
≤2.2.0No patch available
- Critical9.8Unauthenticated Remote Code Execution
Drag and Drop Multiple File Upload for Contact Form 7
<1.3.9.9Update to 1.3.9.9
- Critical9.1Unauthenticated Arbitrary File Deletion
WooCommerce File Approval
≤10.7No patch available
- Medium5.3Missing Authorization
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1223Update to 4.1224
- Medium4.3Cross-Site Request Forgery
Hash Form – Drag & Drop Form Builder
≤1.4.0Update to 1.4.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Drag and Drop Multiple File Upload for Contact Form 7
<1.3.9.9Update to 1.3.9.9
- Medium4.3Cross-Site Request Forgery
LitExtension – Automated Store Migration & Import
≤1.2.6Update to 1.2.7
- Medium5.3Unauthenticated Like Count Manipulation
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1066Update to 1.7.1066
- Critical9.8Authentication Bypass via Account Takeover
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
<3.9.8Update to 3.9.8
- Medium5.34.0.6 - Unauthenticated Subscriber Account Creation
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
2.1.0 – 4.0.6Update to 4.0.7
- Medium5.3Unauthenticated Information Exposure
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
<5.0.14Update to 5.0.14
- High7.2Unauthenticated Stored Cross-Site Scripting
Toolset Blocks
≤1.6.26Update to 1.6.27
- Medium6.5Authenticated (Shop Manager+) Arbitrary File Deletion
Order Tip for WooCommerce
<1.6.0Update to 1.6.0
- Medium5.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.7.5Update to 2.7.6
- Medium5.3Missing Authorization
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages
≤3.7.0Update to 3.7.1
- High7.5Unauthenticated SQL Injection
Woo essential
≤4.3.0No patch available
- Medium5.3Missing Authorization
Passster – Password Protect Pages and Content
<4.3.9Update to 4.3.9
- Medium4.3Missing Authorization
Duplicate Post
<1.5.6Update to 1.5.6
- Medium4.3Missing Authorization
Prolancer Element
≤1.4.8No patch available
- Medium4.3Missing Authorization
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
<5.0.14Update to 5.0.14
- Medium5.3Unauthenticated Payment Bypass
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<3.2.5Update to 3.2.5
- Medium6.5Authenticated (Subscriber+) SQL Injection
Prolancer Element
≤1.4.8No patch available
- Medium4.3Cross-Site Request Forgery
Fluent Support Pro
≤2.3.1Update to 2.3.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Fluent Boards Pro
≤2.0.11Update to 2.0.12