Database
WordPress Vulnerability Database (page 167)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter
Autopay
≤5.0.0Update to 5.0.1
- Medium6.5Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
Simply Schedule Appointments
≤1.6.12.10Update to 1.6.12.11
- Medium6.1Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
≤5.4.12Update to 5.4.13
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting
Admin Custom Login
≤3.6.4Update to 3.6.5
- Critical9.8Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router
Pods – Custom Content Types and Fields
≤3.3.9Update to 2.8.23.4 or 2.9.19.4 or 3.0.10.4 or 3.1.4.2 or 3.2.8.3 or 3.3.9.1
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤27.7Update to 28.0
- Critical9.1Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
Solace Extra
≤1.6.0Update to 1.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
≤5.6.8Update to 5.6.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.1Update to 11.2.2
- Medium4.3Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.5.2Update to 3.5.3
- Medium6.5Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL
StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More
≤2.1.1Update to 2.2.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
School Management System for Wordpress
≤93.1.0No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion via link_url Parameter
Link Library
≤7.9.4Update to 7.9.5
- High8.8Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
≤3.7.1Update to 3.7.2
- High7.5Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision
Real Estate Manager Pro
≤12.8.6Update to 12.8.7
- Critical9.8Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter
TrueBooker – Appointment Booking and Scheduler System
≤1.2.6Update to 1.2.7
- Critical9.8Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.16.4Update to 3.16.5
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter
Wholesale Market
≤2.2.2No patch available
- Medium6.5Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter
KiviCare – Clinic & Patient Management System (EHR)
≤4.5.1Update to 4.5.2
- Medium6.5Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5.14Update to 4.5.15
- High7.2Unauthenticated Stored Cross-Site Scripting via 'action' Parameter
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
≤5.1Update to 5.1.1
- Medium4.9Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
≤5.1Update to 5.1.1
- Medium6.4Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.2Update to 1.2.3
- Medium6.5Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤30.0.7Update to 31.0.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.10.2.2Update to 2.10.3.2
- Medium6.5Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter
Image Uploader for Welcart
≤1.4.6No patch available
- Medium5.3Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
Pinpoint Booking System – Legacy version
≤2.9.9.6.9Update to 2.9.9.7.0
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
Booking calendar, Appointment Booking System
≤3.2.36No patch available
- High8.8Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter
Propovoice: All-in-One Client Management System
≤1.7.8No patch available
- High7.5Unauthenticated SQL Injection
Object Sync for Salesforce
≤2.2.13No patch available