Database
WordPress Vulnerability Database (page 156)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Ultimate AI
≤3.1.0No patch available
- Medium4.9Authenticated (Editor+) SQL Injection
Link Whisper Free
<0.9.7Update to 0.9.7
- Medium5.3Unauthenticated Payment Bypass
Tamara Checkout
≤1.9.9.20Update to 1.9.9.21
- Medium4.7Authenticated (Administrator+) Privilege Escalation
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.6.0Update to 3.6.1
- Medium5.3Unauthenticated Order Completion
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.19Update to 4.1.19
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.21Update to 4.1.21
- Medium6.5Authenticated (Author+) SQL Injection
Media Library Assistant
<3.40Update to 3.40
- Medium4.3Missing Authorization
Duplicate Post
<1.5.6Update to 1.5.6
- Critical9.8Unauthenticated Remote Code Execution
Kirki – Freeform Page Builder, Website Builder & Customizer
<6.2.1Update to 6.2.1
- High7.2Tour Booking, Travel, Hotel <= 5.4.9 - Unauthenticated Stored Cross-Site Scripting
Tour Master - Tour Booking, Travel, Hotel
≤5.4.9No patch available
- Medium5.3Unauthenticated Information Exposure
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
<8.5.1Update to 8.5.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
<8.5.1Update to 8.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
≤1.8.6Update to 1.8.7
- Medium5.3Unauthenticated Price Manipulation
Booking Package
<1.7.25Update to 1.7.25
- Critical9.1Unauthenticated Arbitrary File Deletion
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.42Update to 3.7.43
- High8.8Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite
Security Hardener
≤2.4.4Update to 2.4.5
- High8.8Authenticated (Contributor+) PHP Object Injection via post_protection_roles
PPWP – Password Protect Pages
≤1.9.18Update to 1.9.19
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
≤4.9.8Update to 5.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute
Image Photo Gallery Final Tiles Grid
≤3.6.12Update to 3.6.13
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
Themify Builder
≤7.8.0Update to 7.8.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤5.8.4Update to 5.8.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤5.8.4Update to 5.8.5
- High8.8Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
WPeMatico RSS Feed Fetcher
≤2.8.24Update to 2.8.25
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Project Manager Pro
≤4.0.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
<0.8.6Update to 0.8.6
- Medium5.3Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
<1.2.7Update to 1.2.7
- Medium5.3Unauthenticated Information Exposure
Membership For WooCommerce
<3.1.2Update to 3.1.2
- Medium4.3Missing Authorization
SmartCrawl SEO checker, analyzer & optimizer
<3.16.3Update to 3.16.3
- Medium5.3Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
kk Star Ratings – Rate Post & Collect User Feedbacks
≤5.4.10.3Update to 5.4.10.4
- Critical9.8Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys
Mailgun for WordPress
≤2.2.0Update to 2.2.1