Database
WordPress Vulnerability Database (page 165)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.20Update to 4.1.21
- Medium6.1Reflected Cross-Site Scripting
ProSolution WP Client
<2.0.11Update to 2.0.11
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.20Update to 4.1.21
- High7.2Unauthenticated Stored Cross-Site Scripting
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.33.4Update to 2.33.5
- Medium5.3Unauthenticated Insecure Direct Object Reference
User Verification by PickPlugins
<2.0.48Update to 2.0.48
- Medium6.1Reflected Cross-Site Scripting
ProSolution WP Client
<2.0.11Update to 2.0.11
- Medium5.4Insecure Direct Object Reference to Authenticated (Store vendor+) Cross-Vendor Review Deletion and Status Update
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.0Update to 3.8.1
- High8.8Authenticated (Contributor+) Remote Code Execution
Cwicly
≤1.4.4No patch available
- Medium6.1Reflected Cross-Site Scripting
SSL Zen — SSL Certificate Installer & HTTPS Redirects
≤4.7.43No patch available
- High7.5Unauthenticated SQL Injection
Dinatur
≤1.18No patch available
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.3Update to 11.2.4
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
[凹凸曼] 一键采集微信文章
≤2.0.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Mayosis Core
≤5.4.7No patch available
- Medium4.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.20Update to 4.1.21
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.20Update to 4.1.21
- High7.2Unauthenticated Stored Cross-Site Scripting
Booking calendar, Appointment Booking System
≤3.2.36No patch available
- Medium6.1Reflected Cross-Site Scripting
NextScripts: Social Networks Auto-Poster
<4.4.8Update to 4.4.8
- Medium4.3Missing Authorization
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
≤5.4.12Update to 5.4.13
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Easy Media Replace
≤0.2.0No patch available
- High8.1Unauthenticated Arbitrary Remote Script Inclusion
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
<1.14.2Update to 1.14.2
- Medium5.3Unauthenticated Username Denylist Bypass
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
<3.3.5Update to 3.3.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Chaty Pro
≤3.5.8Update to 3.5.9
- Critical9.1Unauthenticated Arbitrary File Deletion
Frontend File Manager Plugin
≤23.6No patch available
- Critical9.8Unauthenticated PHP Object Injection
Contact Form, Survey, Quiz & Popup Form Builder – ARForms
≤1.8.5Update to 1.8.6
- High7.2Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint
Infility Global
≤2.15.34Update to 2.15.35
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.1.1Update to 6.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
Online Scheduling and Appointment Booking System – Bookly
≤27.7Update to 28.0
- Medium4.9Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.1.1Update to 6.2.0
- High7.2Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress
≤4.7.9Update to 4.8.0
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.55.0.2Update to 1.55.1