Database
WordPress Vulnerability Database (page 169)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated Arbitrary File Download
Extra Product Options & Add-Ons for WooCommerce
<7.6Update to 7.6
- High8.1Unauthenticated PHP Object Injection
FundEngine – Donation and Crowdfunding Platform
≤1.7.9Update to 1.8.0
- Medium4.3Missing Authorization
Cookiez – GDPR & CCPA Cookie Banner & Consent Manager
<0.0.10Update to 0.0.10
- Medium4.9Authenticated (Shop Manager+) Arbitrary File Downloaf
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤6.6.47Update to 6.6.48
- Medium4.3Authenticated (Custom role+) Information Exposure
Booking for Appointments and Events Calendar – Amelia
<2.4.6Update to 2.4.6
- Medium5.3Unauthenticated Information Exposure
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
<1.17.3Update to 1.17.3
- Medium4.3Missing Authorization
WP Crowdfunding
<2.2.1Update to 2.2.1
- High7.5Authenticated (Customer+) PHP Object Injection
Essential Real Estate
≤5.3.3Update to 5.3.4
- Medium5.3Unauthenticated Denial of Service
Kadence Starter Templates — Predesigned Website Templates
≤2.3.3Update to 2.3.4
- High7.2Unauthenticated Server-Side Request Forgery
OttoKit: All-in-One Automation Platform
≤1.1.35Update to 1.1.36
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Content Deletion
Breeze Cache
≤2.5.12Update to 2.5.13
- Medium5.3Unauthenticated PHP Object Injection
WooCommerce Subscription
<9.1.0Update to 9.1.0
- High7.2Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.3.5Update to 4.4.0
- Medium5.3Missing Authorization
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.5.1Update to 4.16.6
- Critical9.8Unauthenticated Privilege Escalation
KiviCare – Clinic & Patient Management System (EHR)
<4.5.2Update to 4.5.2
- Medium4.3Unauthenticated Payment Bypass
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
<2.7.10Update to 2.7.10
- High8.1Unauthenticated Local File Inclusion
Theme Test Drive
≤2.9.1No patch available
- Medium4.3Missing Authorization
Ecwid by Lightspeed Ecommerce Shopping Cart
<7.0.9Update to 7.0.9
- Medium5.3Unauthenticated Information Exposure
Import WP – CSV & XML Import Export for WordPress
<2.14.23Update to 2.14.23
- Critical9.8Authentication Bypass
Ezoic
≤2.22.11Update to 2.23.1
- Critical9.8Unauthenticated Account Takeover via 'mergewith' Parameter
Wishlist Member
≤3.34.1Update to 3.34.2
- Medium6.5Authenticated (Administrator+) SQL Injection via 'filterText' Parameter
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
≤3.2.0Update to 3.2.1
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.8.8Update to 3.8.9
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
W3 Total Cache
≤2.10.3Update to 2.10.4
- Medium4.3Authenticated (Customer+) Information Exposure
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.18Update to 4.1.19
- Medium5.3Missing Authorization
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.2Update to 1.2.3
- Medium4.3Missing Authorization
Service Finder Bookings
≤6.2No patch available
- Medium4.3Authenticated (Custom role+) Information Exposure
KiviCare – Clinic & Patient Management System (EHR)
<4.5.2Update to 4.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
ToneDen Shortcode
≤358No patch available
- Medium4.3Missing Authorization
ECS – Ele Custom Skin for Elementor
≤4.3.7Update to 4.3.8