Database
WordPress Vulnerability Database (page 164)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Fluent Forms Pro Add On Pack
<6.2.12Update to 6.2.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress
≤2.0.7Update to 2.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.39Update to 3.40
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ACF Frontend Admin by DynamiApps
≤3.29.10Update to 3.29.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Video Conferencing with Zoom
≤4.6.9Update to 4.6.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Wufoo Shortcode
≤1.55No patch available
- High8.1Unauthenticated Local File Inclusion
Restaurant Menu and Food Ordering
≤2.4.11Update to 2.4.12
- Medium5.3Missing Authorization
Flutterwave WooCommerce
≤3.3.1Update to 3.3.2
- High7.5Unauthenticated SQL Injection
Depicter — Popup & Slider Builder
≤4.8.0Update to 4.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
<1.5.0Update to 1.5.0
- Medium4.3Cross-Site Request Forgery
Slider by 10Web – Responsive Image Slider
≤1.2.63No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Multilang – Translation and Multilingual Plugin
≤2.4.31Update to 2.4.32
- Medium5.3Missing Authorization
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
<1.5.0Update to 1.5.0
- High8.1Unauthenticated PHP Object Injection
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.13.0Update to 1.13.1
- Medium4.3Missing Authorization
RTMForm – Contact Form, Multi-Step Forms & Form Templates for Elementor
≤1.2.6Update to 1.2.7
- Medium4.3Missing Authorization
Gravity Booster – Styles & Layouts for Gravity Forms
≤6.1No patch available
- Medium4.3Missing Authorization
WP Table Builder – Drag & Drop Table Builder
≤2.2.0Update to 2.2.1
- Medium5.3Unauthenticated Information Exposure
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
≤1.16.20Update to 1.16.21
- Medium5.3Unauthenticated Information Exposure
Shortcodes and extra features for Phlox theme
≤2.17.22No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Razorpay for WooCommerce
≤4.8.7Update to 4.8.8
- Critical9.8Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.56.1Update to 1.56.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint
WPAdverts – Classifieds Plugin
≤2.3.2Update to 2.3.3
- High8.1Unauthenticated PHP Object Injection
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
≤1.13.0Update to 1.14.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Subscribe2 – Form, Email Subscribers & Newsletters
≤10.47Update to 10.48
- Medium5.3Missing Authorization
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More
<6.5Update to 6.5
- High7.5Unauthenticated SQL Injection
Modern Events Calendar
<7.35.0Update to 7.35.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
Gravity Bookings
≤2.1No patch available
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Sync Post With Other Site
≤1.9.3Update to 1.9.4
- Medium5.3Missing Authorization
Contact Form to Chat Apps | Click to Chat to Order – FormyChat
≤2.15.7Update to 2.15.8
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.3Update to 11.2.4