Database
WordPress Vulnerability Database (page 166)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤6.8.4Update to 6.8.5
- Medium6.5Cross-Site Request Forgery to Arbitrary Options Deletion
WP Compress – Instant Performance & Speed Optimization
≤7.10.09Update to 7.20.01
- High7.2Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine
WCPOS – Point of Sale (POS) plugin for WooCommerce
≤1.9.14Update to 1.9.15
- Medium4.9Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
≤2.7.0Update to 2.7.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode
Video Gallery – YouTube Gallery, Playlist & Video Grid
≤4.0.4Update to 4.0.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter
User Login History
≤2.1.7Update to 2.1.8
- Medium6.6Authenticated (Administrator+) PHP Object Injection
Turnkey bbPress by WeaverTheme
≤1.7.1Update to 1.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta
Toocheke Companion
≤2.10Update to 2.11
- Medium6.5Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter
The School Management – Education & Learning ERP
≤5.4Update to 5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute
SureDash – Community, Courses & Member Dashboard
≤1.10.3Update to 1.10.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Snippet Shortcodes
≤5.2.0Update to 5.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
≤4.9.0Update to 4.10.0
- Medium4.9Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)
Slider Hero with Video Background, Animation
≤9.1.7Update to 9.1.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
≤3.11.5Update to 3.11.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute
Serious Slider
≤1.4.0Update to 1.4.1
- High8.8Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1064Update to 1.7.1065
- Medium6.5Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.1Update to 11.2.2
- High8.8Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter
Query Wrangler
≤1.5.57Update to 1.5.58
- Critical9.8Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override
ProSolution WP Client
≤2.0.10Update to 2.0.11
- Critical9.1Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters
ProSolution WP Client
≤2.0.8Update to 2.0.9
- Medium5.3Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter
Product Table & List Builder for WooCommerce
≤5.6.0Update to 5.6.5
- High8.8Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter
Podlove Podcast Publisher
≤4.5.3Update to 4.5.4
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update
PPWP – Password Protect Pages
≤1.9.20Update to 1.9.21
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.16.19Update to 4.17.0
- Medium4.9Authenticated (Admin+) SQL Injection via 'additional_params' Parameter
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.2.4Update to 9.2.5
- Medium6.4Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments
Loco Translate
≤2.8.7Update to 2.8.8
- Medium4.3Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action
Kubio AI Page Builder
≤2.8.5Update to 2.8.6
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter
Gravity Booster – Styles & Layouts for Gravity Forms
≤5.26Update to 6.0
- Medium6.5Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content
Fullscreen Galleria
≤1.6.12Update to 1.6.13
- Critical9.8Unauthenticated Privilege Escalation via 'item_id' Parameter
ACF Frontend Admin by DynamiApps
≤3.29.9Update to 3.29.10