Database
WordPress Vulnerability Database (page 160)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Visualizer – Tables & Charts Manager with Built-in AI Generator
<4.0.7Update to 4.0.7
- Critical9.8Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass
Elementor Website Builder Pro
≤4.2.1Update to 4.2.2
- Medium5.3Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint
AI Agent by SiteGround
≤1.2.7Update to 1.2.8
- High7.5Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
Events Made Easy
≤3.2.5Update to 3.2.6
- Medium6.5Unauthenticated Session Fixation
Welcart e-Commerce
<2.12.1Update to 2.12.1
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.14.1Update to 3.8.14.2
- Critical9.8Unauthenticated SQL Injection
Total Donations
≤2.0.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
GEO Plugin by Squirrly SEO
≤14.2.2Update to 14.2.3
- High8.8Authenticated (Author+) Arbitrary File Upload
Media Library Assistant
≤3.39Update to 3.40
- High7.2Unauthenticated Stored Cross-Site Scripting
SmartSMTP
≤1.2.0Update to 1.2.1
- High8.1Unauthenticated PHP Object Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.0Update to 1.57.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Newsletter – Send awesome emails from WordPress
≤9.3.3Update to 9.3.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Podlove Podcast Publisher
≤4.5.4Update to 4.5.5
- Medium5.3Missing Authorization
Chaplin
≤2.6.8Update to 2.6.9
- High8.1Unauthenticated PHP Object Injection
FundEngine – Donation and Crowdfunding Platform
≤1.7.9Update to 1.8.0
- High7.2Unauthenticated Stored Cross-Site Scripting
BBQ Pro
≤3.9Update to 3.9.1
- High8.1Unauthenticated PHP Object Injection
Kalles Addons
≤1.0.6No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Persistent Login
≤3.1.0Update to 3.1.1
- High7.5Authenticated (Customer+) PHP Object Injection
Flexible Subscriptions
≤1.8.1Update to 1.8.2
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin
≤5.4.5Update to 5.4.6
- High7.2Unauthenticated Stored Cross-Site Scripting
wpDataTables (Premium)
≤6.5.1.4Update to 6.5.1.5
- Medium5.3Unauthenticated Information Exposure
Track Geolocation Of Users Using Contact Form 7
≤3.0.2Update to 3.0.3
- Medium5.3Unauthenticated Information Exposure
Pay with Contact Form 7
≤1.0.4No patch available
- Medium5.3Missing Authorization
Outranking Plugin Options
≤1.1.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Swatchly – Product Variation Swatches for WooCommerce
≤1.4.13Update to 1.4.14
- High7.5Unauthenticated SQL Injection
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.184Update to 2.185
- High7.2Unauthenticated Stored Cross-Site Scripting
Advance Product Search- Voice & Ajax Search for WooCommerce
≤1.4.8Update to 1.4.9
- High7.2Unauthenticated Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.173Update to 2.8.174
- Medium6.6Authenticated (Editor+) PHP Object Injection
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.51.0Update to 3.52.0
- Medium4.3Missing Authorization
Leyka
≤3.32.3No patch available