Database
WordPress Vulnerability Database (page 172)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.169Update to 2.8.170
- Critical9.8Unauthenticated Arbitrary File Deletion via Signature Field
Formidable Digital Signatures
≤3.0.6Update to 3.1
- High7.5Unauthenticated Cryptographic Key Disclosure
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.3.6Update to 0.1.3.7
- High8.8Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤10.11.1Update to 11.0.0
- Medium4.3Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.4Update to 6.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Embed Google Photos album
≤2.2.1No patch available
- Medium4.3Missing Authorization
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤2.23.1Update to 2.23.2
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
Vehica Core
≤1.0.104No patch available
- High7.5Unauthenticated SQL Injection
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
≤1.2.12Update to 1.2.13
- Medium6.1Reflected Cross-Site Scripting
NOPARCELS / MultiParcels Shipping For WooCommerce
≤1.30.36Update to 1.30.37
- Medium5.9Unauthenticated SQL Injection
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium5.3Missing Authorization
Contact Form 7 – PayPal & Stripe Add-on
≤2.5.1Update to 2.5.2
- Medium4.3Missing Authorization
Solace Extra
≤1.6.0Update to 1.6.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Welcart e-Commerce
≤2.11.31Update to 2.11.32
- Critical9.8Unauthenticated Privilege Escalation
MStore API – Create Native Android & iOS Apps On The Cloud
≤4.20.0Update to 4.21.0
- Critical9.8Unauthenticated Privilege Escalation
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.1Update to 5.5.2
- Critical9.8Unauthenticated Privilege Escalation
Customer Email Verification for WooCommerce
<3.2.6Update to 3.2.6
- Critical9.8Unauthenticated Remote Code Execution
WP BASE Booking of Appointments, Services and Events
≤6.3.0Update to 6.3.1
- High8.1Unauthenticated Local File Inclusion
Biagiotti Core
≤2.1.1No patch available
- Medium4.3Missing Authorization
Ray Enterprise Translation
≤1.7.4Update to 1.7.5
- High7.5Unauthenticated SQL Injection
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤5.6.0Update to 5.7.0
- Critical9.8Unauthenticated Remote Code Execution
QA Assistants – Driven by data
≤5.2.0.0Update to 5.2.0.1
- Medium4.3Cross-Site Request Forgery
ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets
≤4.9.2Update to 4.9.3
- High7.2Unauthenticated Stored Cross-Site Scripting
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
≤4.3.3Update to 4.3.4
- Medium5.3Unauthenticated Payment Bypass
Epeken All Kurir for Woocommerce
<2.1.8Update to 2.1.8
- High8.1Unauthenticated Local File Inclusion
Foton Core
≤1.1.1No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
reviewer
≤3.14.2No patch available
- High8.1Unauthenticated Local File Inclusion
Barista
≤2.5.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.11.2Update to 1.12.0
- Medium6.4Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1