Database
WordPress Vulnerability Database (page 171)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Clean, Minimal Shop WooCommerce WordPress <= 2.5 - Reflected Cross-Site Scripting
Samex - Clean, Minimal Shop WooCommerce WordPress Theme
≤2.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search
≤17.211.0Update to 17.212.0
- High8.8Authenticated (Subscriber+) Remote Code Execution
Thim Core
≤2.3.3No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Piotnet Addons For Elementor Pro
≤7.1.67No patch available
- Medium4.3Authenticated (Contributor+) Information Exposure
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.20Update to 4.1.20
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤10.11.1Update to 11.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
PPWP – Password Protect Pages
≤1.9.21Update to 1.9.22
- High7.2Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.11Update to 6.2.12
- Medium5.3Unauthenticated Protected File Access
Prevent Direct Access – Protect WordPress Files
≤2.8.8.8Update to 2.8.8.9
- High8.1Unauthenticated PHP Object Injection
Headless SSO Plugin for WP
≤1.6Update to 1.6.1
- Medium5.3Missing Authorization
OAuth Single Sign On – SSO (OAuth Client)
≤7.0.0Update to 7.0.1
- Medium5.3Missing Authorization
Headless SSO Plugin for WP
≤1.6Update to 1.6.1
- High8.8Authenticated (Author+) Remote Code Execution via Malicious File Upload
WordPress
≤7.0.3Update to 4.7.35 or 4.8.30 or 4.9.31 or 5.0.27 or 5.1.24 or 5.2.26 or 5.3.23 or 5.4.21 or 5.5.20 or 5.6.19 or 5.7.17 or 5.8.15 or 5.9.16 or 6.0.14 or 6.1.12 or 6.2.11 or 6.3.10 or 6.4.10 or 6.5.10 or 6.6.7 or 6.7.7 or 6.8.8 or 6.9.7 or 7.0.4
- Medium4.9Authenticated (Administrator+) SQL Injection
Mailchimp for WooCommerce
<6.2Update to 6.2
- High7.5Unauthenticated SQL Injection
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium5.3Missing Authorization
GiveWP – Donation Plugin and Fundraising Platform
<4.16.6Update to 4.16.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Spam Protection | Maspik
≤2.9.1Update to 2.9.2
- Medium6.4Authenticated (Donor+) Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<4.16.6Update to 4.16.6
- High7.3Unauthenticated Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.7.1Update to 6.7.2
- High7.5Unauthenticated SQL Injection
Paymob for WooCommerce
≤4.1.8Update to 4.1.9
- Medium6.6Authenticated (Editor+) PHP Object Injection
Car Rental Manager – Online Vehicle Booking System
≤1.3.9Update to 1.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.25Update to 6.4.26
- High7.5Unauthenticated SQL Injection
Web Directory plugin Free – AI powered
≤1.7.13Update to 2.0
- Medium5.3Missing Authorization
Revolut Gateway for WooCommerce
<4.22.10Update to 4.22.10
- Medium6.5Authenticated (Subscriber+) SQL Injection
Booktics – Appointment Booking Calendar for Service Businesses
1.0.22 – 1.0.22Update to 1.0.23
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.79Update to 5.5.80
- Medium5.3Missing Authorization
WebHosting4U Secure Card Gateway for ePay Paycenter (Piraeus Bank)
≤1.0.32Update to 1.0.33
- Medium6.4Authenticated (Contributor+) Stored Cross-site Scripting
Featured Image from URL (FIFU)
≤5.3.3Update to 6.0.0
- High8.1Unauthenticated Authentication Bypass via Spotify OAuth Callback
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect
≤1.4.3Update to 1.4.4
- High8.8Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
ACF Frontend Admin by DynamiApps
≤3.29.9Update to 3.29.10