Database
WordPress Vulnerability Database (page 162)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content
EWWW Image Optimizer
≤8.7.3Update to 8.7.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.8Update to 14.16.9
- High8.1Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback
≤5.1.1Update to 5.1.2
- Critical9.8Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
TrueBooker – Appointment Booking and Scheduler System
≤1.2.6Update to 1.2.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
Speed Optimizer – The All-In-One Performance-Boosting Plugin
≤7.8.0Update to 7.8.1
- Medium4.3Improper Authorization To Authenticated (Contributor+) Master Password Exposure
PPWP – Password Protect Pages
≤1.9.15Update to 1.9.16
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Templatiq
≤0.2.5No patch available
- Medium5.3Missing Authorization
Online Contact Widget-多合一在线客服插件
≤1.3.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Wise Chat
≤3.4.1Update to 3.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
EasyTest – Simplify A/B Testing
≤1.0.1Update to 1.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.4Update to 6.2.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Login, Social Sharing by miniOrange
≤7.8.1Update to 7.8.2
- Medium5.3Missing Authorization
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
≤3.5.1Update to 3.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Tab Widget
≤1.2.11No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.177Update to 2.8.178
- Medium5.3Missing Authorization
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.11.3Update to 1.8.12
- Medium6.5Authenticated (Customer+) SQL Injection
License Manager for WooCommerce
≤3.0.18Update to 3.0.19
- Medium4.3Missing Authorization
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
≤5.2.30Update to 5.2.40
- Medium5.3Missing Authorization
Piraeus Bank WooCommerce Payment Gateway
3.2.0 – 3.2.0No patch available
- Medium5.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.17No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Table Of Contents Block
≤1.5.0Update to 1.5.1
- Medium4.3Missing Authorization
MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics
≤1.6.7Update to 1.6.8
- High8.1Unauthenticated PHP Object Injection
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
<1.5.0Update to 1.5.0
- Medium5.3Unauthenticated Information Exposure
Duitku Payment Gateway
≤2.11.14No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Draft List
≤2.6.4Update to 2.6.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
<1.10.0Update to 1.10.0
- Critical9.8Unauthenticated Remote Code Execution
WP Compress – Instant Performance & Speed Optimization
<7.20.01Update to 7.20.01
- Medium5.3Unauthenticated Insecure Direct Object Reference
Booking calendar, Appointment Booking System
≤3.2.36No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects
≤4.5.1Update to 4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Typing Effect
≤1.3.7No patch available