Database
WordPress Vulnerability Database (page 161)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Paymob for WooCommerce
≤4.1.10Update to 4.1.11
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP w3all phpBB
≤3.0.5Update to 3.0.6
- Critical9.8Unauthenticated Remote Code Execution
JetEngine
≤3.8.14Update to 3.8.14.1
- Medium5.3Missing Authorization
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.80Update to 5.5.81
- High7.2WordPress Responsive Gallery <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting
Global Gallery - WordPress Responsive Gallery
≤11.1.2No patch available
- High7.5Unauthenticated SQL Injection
Maps Marker Pro
≤4.32Update to 4.32.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
Community by PeepSo – Download from PeepSo.com
≤9.0.5.2Update to 9.0.5.3
- High8.1Unauthenticated Local File Inclusion
Golo Framework
<1.7.5Update to 1.7.5
- High7.5Unauthenticated SQL Injection
Nikstore Core
≤1.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
SimplyRETS Real Estate IDX
≤3.2.8Update to 3.2.9
- High7.3Unauthenticated Privilege Escalation
SAML Single Sign On – SSO Login
4.8.85 – 5.4.6Update to 5.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
B2Bking
≤5.6.07Update to 5.6.08
- High7.5Creative Multi-Purpose & WooCommerce WordPress Theme <= 5.12.3 - Unauthenticated SQL Injection
TheGem
≤5.12.3Update to 5.12.3.1
- High8.8Authenticated (Subscriber+) Remote Code Execution
Query Wrangler
≤1.5.57Update to 1.5.58
- Medium5.3Missing Authorization
Altair
≤5.2.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Tagembed: Social Media Feeds and Customer Reviews Widget
≤7.4Update to 7.5
- High7.5Unauthenticated SQL Injection
NGG Smart Image Search
<4.0.0Update to 4.0.0
- High7.5Unauthenticated SQL Injection
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.11Update to 4.7.12
- High7.3Unauthenticated Privilege Escalation
TrueBooker – Appointment Booking and Scheduler System
≤1.2.6Update to 1.2.7
- High8.1Real Estate WordPress Theme <= 1.5 - Unauthenticated Local File Inclusion
Resido - Real Estate WordPress Theme
≤1.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.2Update to 3.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤30.0.5Update to 30.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.49Update to 1.15.50
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Media Library Assistant
≤3.39Update to 3.40
- High8.1Unauthenticated Local File Inclusion
Shuffle
≤1.8Update to 1.9
- Medium5.3Missing Authorization
E-cab Taxi Booking Manager for Woocommerce
<2.0.8Update to 2.0.8
- Critical9.8Unauthenticated Privilege Escalation
Total Donations
≤2.0.5No patch available
- Medium5.3Missing Authorization
Stitch Express
≤1.9.1No patch available
- Medium5.3Missing Authorization
Koji
≤2.2.1Update to 2.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
TranslatePress – Translate Multilingual sites with AI Translation
≤3.2.5Update to 3.2.6