Database
WordPress Vulnerability Database (page 170)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) Privilege Escalation
Service Finder Bookings
≤6.2No patch available
- Medium4.3Authenticated (Contributor+) Information Exposure
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.20Update to 4.1.20
- Medium4.3Cross-Site Request Forgery to Settings Reset
Astro Booking Engine
≤1.4.0Update to 1.4.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
CubeWP Framework
≤1.1.30Update to 1.1.31
- Medium6.5Authenticated (Subscriber+) SQL Injection
ToneDen Shortcode
≤358No patch available
- High8.1Unauthenticated PHP Object Injection
Booking Activities
≤1.18.4Update to 1.18.5
- Medium4.3Missing Authorization
Tourfic Toolkit
≤1.5.1Update to 1.5.2
- Medium5.3Unauthenticated Information Exposure
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
≤13.5.6Update to 13.5.7
- High8.8Authenticated (Subscriber+) Privilege Escalation
The Grid
≤2.8.0Update to 2.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Blog Floating Button
≤1.4.20Update to 1.4.21
- High7.2Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting
Tour Master - Tour Booking, Travel, Hotel
<5.4.8Update to 5.4.8
- Critical9.1Unauthenticated Arbitrary File Deletion
Participants Database
≤2.7.8.4Update to 2.7.8.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Mang Board
≤2.3.4Update to 2.3.5
- Medium4.3Missing Authorization
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤10.11.1Update to 11.0.0
- Medium4.3Authenticated (Team Member+) Information Exposure
Simply Schedule Appointments
≤1.6.12.16Update to 1.6.12.17
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Photo Album Plus
<9.2.04.003Update to 9.2.04.003
- Medium4.3Authenticated (Subscriber+) Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.4.4Update to 4.4.4
- Medium4.7Authenticated (Administrator+) Privilege Escalation
Backup Migration
≤2.1.6Update to 2.1.7
- Medium5.3Missing Authorization
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.3.7Update to 0.1.3.8
- Medium6.5Authenticated (Subscriber+) Path Traversal
ToneDen Shortcode
≤358No patch available
- Medium4.3Authenticated (Customer+) Arbitrary Content Deletion
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.19Update to 4.1.20
- Medium5.3Unauthenticated Insecure Direct Object Reference
ToneDen Shortcode
≤358No patch available
- High7.5Unauthenticated Arbitrary File Download
OMGF Pro
≤5.2.7Update to 5.2.8
- Medium5.3Missing Authorization
WPMobile.App – Android and iOS App Builder
≤11.77Update to 11.78
- Medium5.3Missing Authorization to Unauthenticated Private Content Disclosure
ECS – Ele Custom Skin for Elementor
≤4.3.7Update to 4.3.8
- Critical9.8Unauthenticated Privilege Escalation
SAML Single Sign On – SSO Login
≤5.4.3Update to 5.4.4
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.6Update to 5.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Visitor Traffic Real Time Statistics
≤8.11Update to 8.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ECS – Ele Custom Skin for Elementor
≤4.3.7Update to 4.3.8
- Critical9.8Authentication Bypass
Log in with Google
≤1.4.2Update to 1.4.3