Database
WordPress Vulnerability Database (page 163)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.7Update to 6.0.9.8
- Medium4.3WordPress Poll, Survey & Quiz Plugin <= 2.0.2.2.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Modal Survey - WordPress Poll, Survey & Quiz Plugin
≤2.0.2.2.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Premium Packages – Sell Digital Products Securely
≤7.0.5Update to 7.0.6
- High7.2Unauthenticated Server-Side Request Forgery
PDF Smart Viewer for Elementor
≤1.0.4No patch available
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.41Update to 3.7.42
- High7.5Unauthenticated SQL Injection
Affiliates Manager
≤2.9.53Update to 2.9.54
- Medium5.3Missing Authorization
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.13.0Update to 1.13.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliates Manager
≤2.9.53Update to 2.9.54
- High8.1Unauthenticated PHP Object Injection
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.3.7No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Issues and Series for Newspapers, Magazines, Publishers, Writers
≤2.17.0Update to 2.17.1
- Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.41Update to 3.7.42
- High8.8Authenticated (Contributor+) Arbitrary File Upload
GP Premium
≤2.5.5Update to 2.5.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Dashboard PRO
≤3.11.2Update to 3.11.3
- Medium6.6Authenticated (Editor+) PHP Object Injection
OptionTree
≤2.7.3No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.3.2Update to 2.3.3
- Medium4.3Cross-Site Request Forgery
HashBar – Announcement, Notification Bar & Popup Campaign
≤2.0.0Update to 2.0.1
- Medium5.3Missing Authorization
Appointment Hour Booking – Booking Calendar
≤1.5.94Update to 1.5.95
- High7.5Unauthenticated SQL Injection
JetAppointment
≤2.5.2Update to 2.5.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Autopay
≤5.0.0Update to 5.0.1
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
DynamicKit for Elementor
<1.0.3Update to 1.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
URL Shortify – Simple and Easy URL Shortener
≤2.5.0Update to 2.5.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.3.9Update to 4.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Recipe Card Blocks Lite
≤3.4.18Update to 3.4.19
- Medium5.3Unauthenticated Payment Bypass
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
<1.10.0Update to 1.10.0
- High7.5Unauthenticated SQL Injection
Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons
≤1.4.2Update to 1.4.3
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
ShopMonitor.io – Automated Checkout & Form Monitoring
<1.2.0Update to 1.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Featured Video Plus
≤2.3.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.22Update to 2.15.23
- High7.5Unauthenticated SQL Injection
Readabler
<2.0.18Update to 2.0.18
- Medium6.5Authenticated (Subscriber+) SQL Injection
YITH WooCommerce Membership Premium
≤2.33.0Update to 2.33.1