Database
WordPress Vulnerability Database (page 168)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter
Online Booking & Scheduling Calendar by vcita
≤4.6.0Update to 4.6.1
- High8.8Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter
MaxUpload – Big File Uploads – Increase Maximum File Upload Size
≤1.4.0No patch available
- Critical9.8Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
User Session Synchronizer
≤1.4.0No patch available
- Critical9.8Unauthenticated Account Takeover via 'email' Parameter
6Storage Rentals
≤2.28.0Update to 2.29.0
- High8.8Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings
bLoyal: Loyalty & Promotions by bLoyal
≤3.1.611.78Update to 3.1.611.90
- Critical9.1Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters
RapiSafe – Secure Multi File Upload for Contact Form 7
≤1.0.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
≤5.7.1Update to 5.7.2
- Medium4.3Unauthenticated Insecure Direct Object Reference
WP Crowdfunding
<2.2.1Update to 2.2.1
- High8.1Unauthenticated Local File Inclusion
Vavo Core
≤2.3.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
≤3.7.1Update to 3.7.2
- Medium6.45.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Divi
5.0 – 5.8.1Update to 5.9.0
- Medium5.3Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.44Update to 1.15.45
- Medium5.3Unauthenticated Donation Payment Bypass
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
<1.8.12Update to 1.8.12
- Medium5.3Missing Authorization
WP Photo Album Plus
<9.2.07.002Update to 9.2.07.002
- Medium5.3Missing Authorization
WP Sort Order
≤1.3.5Update to 1.3.6
- High7.3Unauthenticated Payment Bypass
Payment Gateway for PayPal on WooCommerce
<9.2.1Update to 9.2.1
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
PowerPress Podcasting plugin by Blubrry
<11.17.1Update to 11.17.1
- Medium4.9Authenticated (Editor+) SQL Injection via 'key' Parameter
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
≤5.1Update to 5.1.1
- Medium5.3Unauthenticated Payment Bypass
Welcart e-Commerce
<2.11.33Update to 2.11.33
- Medium5.3Missing Authorization
Food Menu – Restaurant Menu & Online Ordering for WooCommerce
<6.0.2Update to 6.0.2
- Medium4.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.6Update to 5.2.7
- Medium4.3Missing Authorization
Cookiez – GDPR & CCPA Cookie Banner & Consent Manager
<0.0.10Update to 0.0.10
- Medium5.3Unauthenticated Information Exposure
WP Helper Premium
<4.7.6Update to 4.7.6
- High7.2Unauthenticated Server-Side Request Forgery
WooMS
≤9.14No patch available
- Medium5.3Missing Authorization
GiveWP – Donation Plugin and Fundraising Platform
<4.16.6Update to 4.16.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤8.2.0Update to 8.2.1
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
ShopSmart Loyalty for WooCommerce
≤1.0.0No patch available
- Medium5.3Unauthenticated Information Exposure
Order Sync with Zendesk for WooCommerce
<2.2.3Update to 2.2.3
- Medium6.5Authenticated (Translator+) SQL Injection via 'sorting' Parameter
WPML Multilingual CMS
≤4.9.5Update to 4.9.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
≤5.7.1Update to 5.7.2