Database
WordPress Vulnerability Database (page 173)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Information Exposure
Payment Forms for Paystack
≤4.0.5Update to 4.0.6
- High7.2Unauthenticated Server-Side Request Forgery
Gutenverse Companion
≤2.5.1Update to 2.5.2
- Medium4.3Cross-Site Request Forgery
WP Umbrella: Security Backup Restore & Monitoring
2.24.2 – 2.26.2Update to 2.27.0
- Medium5.3Missing Authorization
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
≤2.1.1Update to 2.1.2
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.0Update to 6.2.1
- Medium6.1Reflected Cross-Site Scripting
WP Photo Album Plus
≤9.2.07.1Update to 9.2.07.002
- High7.5Unauthenticated SQL Injection
Church Admin
≤5.1.1Update to 5.1.2
- Medium4.3Missing Authorization
WP Photo Album Plus
≤9.2.09.1Update to 9.2.09.002
- Medium5.3Unauthenticated User Account Creation
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.20Update to 4.1.20
- Medium5.3Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤6.8.4Update to 6.8.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses
≤2.7.5Update to 2.7.7
- Medium4.3Missing Authorization
ProSolution WP Client
≤2.0.8Update to 2.0.9
- Medium5.3Missing Authorization
Ezoic
≤2.23.0Update to 2.23.1
- High7.5Unauthenticated SQL Injection
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin
≤2.3.12Update to 2.3.13
- Medium5.3Missing Authorization
Cartify - WooCommerce Gutenberg WordPress Theme
≤1.3.0.1No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
WPJAM Basic
≤7.0.1Update to 7.0.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.0Update to 7.4.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Welcart e-Commerce
≤2.11.33Update to 2.11.34
- High7.2Unauthenticated Stored Cross-Site Scripting
Local Delivery Drivers for WooCommerce
≤3.0.0No patch available
- Medium4.3Missing Authorization
Motors – Car Dealership & Classified Listings Plugin
≤1.4.113Update to 1.4.114
- High7.2Unauthenticated Stored Cross-Site Scripting
Smart Online Order for Clover
≤1.6.1Update to 1.6.2
- Medium4.3Wallet for WooCommerce <= 1.6.9 - Missing Authorization to Authenticated (Subscriber+) Wallet Balance Inflation
Wallet for WooCommerce
≤1.6.9Update to 1.6.10
- High7.5Unauthenticated SQL Injection
WP Directory Kit
≤1.5.5Update to 1.5.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Booking Approval Bypass
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.30.19Update to 10.30.20
- Medium4.3Missing Authorization
WP Crowdfunding
≤2.2.0Update to 2.2.1
- Medium6.5Authenticated (Authenticated+) SQL Injection
KiviCare – Clinic & Patient Management System (EHR)
≤4.5.1Update to 4.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Patterns Kit
≤1.0.3No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation
Directories Pro - Directory plugin for WordPress
≤2.0.5No patch available
- Medium5.3Missing Authorization
Arvow AI SEO Writer
≤1.5.3Update to 1.5.4
- High7.3Unauthenticated Privilege Escalation
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.0Update to 7.4.1