Database
WordPress Vulnerability Database (page 157)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple File List
≤6.3.11No patch available
- High7.5Unauthenticated SQL Injection
Product Shortlist
≤1.0.4No patch available
- Medium5.3Unauthenticated Information Exposure
YayCurrency – WooCommerce Multi-Currency Switcher
<3.3.5Update to 3.3.5
- High7.2Authenticated (Administrator+) Remote Code Execution
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1066Update to 1.7.1066
- Medium5.3Unauthenticated Information Exposure
WP Directory Kit
<1.5.7Update to 1.5.7
- Medium4.3Authenticated (Subscriber+) Information Exposure
WPS Bidouille
<1.33.5Update to 1.33.5
- High7.3Unauthenticated Privilege Escalation
TabaPay – درگاه پرداخت تاباپی
<1.4.1Update to 1.4.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Admin and Site Enhancements (ASE)
<9.0.1Update to 9.0.1
- Critical9.8Unauthenticated Remote Code Execution
JSON Options
≤0.0.4No patch available
- High7.5Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request
Advanced Product Fields (Product Addons) for WooCommerce
≤1.6.21Update to 1.6.22
- Medium4.3Missing Authorization
KiviCare – Clinic & Patient Management System (EHR)
<4.5.4Update to 4.5.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages
MC4WP: Mailchimp for WordPress
≤4.12.0Update to 4.12.1
- Medium4.3Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
Post Duplicator
≤3.0.11Update to 3.0.12
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
<2.5.0Update to 2.5.0
- Medium4.3Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'
Greenshift – animation and page builder blocks
≤12.8.9Update to 12.9.0
- Medium4.3Missing Authorization
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<4.9.8Update to 4.9.8
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer
<6.2.3Update to 6.2.3
- Medium4.3Authenticated (Contributor+) Information Exposure
Easy Appointments
<4.0.1Update to 4.0.1
- High7.2Authenticated (Editor+) Arbitrary File Upload
Depicter — Popup & Slider Builder
<4.8.0Update to 4.8.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
≤0.8.5Update to 0.8.6
- Medium5.3Missing Authorization
爱采集数据采集和发布插件
≤1.0.0No patch available
- High7.3Unauthenticated Privilege Escalation
TrueBooker – Appointment Booking and Scheduler System
<1.2.7Update to 1.2.7
- Medium4.3Authorization Bypass to Authenticated (Contributor+) Post Duplication
Post Duplicator
≤3.0.11Update to 3.0.12
- High7.5Unauthenticated Arbitrary File Read
Simple File List
≤6.3.11No patch available
- High7.5Unauthenticated Path Traversal
W3 Total Cache
<2.10.5Update to 2.10.5
- Medium4.3Missing Authorization
WooCommerce Bookings
≤3.8.0Update to 3.9.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
JetEngine
<3.8.14Update to 3.8.14
- Medium4.3Missing Authorization
KiviCare – Clinic & Patient Management System (EHR)
<4.5.4Update to 4.5.4
- Medium4.3Authenticated (Contributor+) Information Exposure
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
≤2.4.15Update to 2.5.0
- Critical9.8Unauthenticated PHP Object Injection via Form Submission
WS Form LITE – Drag & Drop Contact Form Builder
≤1.10.80Update to 1.10.82