Database
WordPress Vulnerability Database (page 175)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.8Unauthenticated Blind Server-Side Request Forgery
WordPress
≤7.0.2Update to 4.7.34 or 4.8.29 or 4.9.30 or 5.0.26 or 5.1.23 or 5.2.25 or 5.3.22 or 5.4.20 or 5.5.19 or 5.6.18 or 5.7.16 or 5.8.14 or 5.9.14 or 6.0.13 or 6.1.11 or 6.2.10 or 6.3.9 or 6.4.9 or 6.5.9 or 6.6.6 or 6.7.6 or 6.8.7 or 6.9.6 or 7.0.3
- Critical9.8Unauthenticated Privilege Escalation via Custom Workflow Route
AI Copilot – Content Generator
≤1.5.6Update to 1.5.8
- Medium5.3Missing Authorization
WP Social Avatar
≤1.5No patch available
- Medium5.3Missing Authorization
Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)
≤1.0.7Update to 1.0.8
- Medium4.3Insecure Direct Object Reference to Authenticated (Provider+) Customer Data Disclosure
Booking for Appointments and Events Calendar – Amelia
≤9.6Update to 9.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Visitor Traffic Real Time Statistics pro
≤11.10Update to 11.11
- High7.2Unauthenticated Stored Cross-Site Scripting
WP-Stats
≤2.56Update to 2.56.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤260804Update to 260805
- Medium6.5Authenticated (Subscriber+) SQL Injection
Visitor Traffic Real Time Statistics pro
≤11.10Update to 11.11
- Medium5.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.10Update to 5.0.11
- Medium5.3Unauthenticated Non-Public Listing Custom Field Disclosure
Advanced Classifieds & Directory Pro
≤3.4.2Update to 3.4.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile Update
FoodBoxBooker
≤1.0.7Update to 1.0.8
- Medium5.3Missing Authorization
Car Rental Manager – Online Vehicle Booking System
≤1.3.7Update to 1.3.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Geo Mashup
≤1.13.18Update to 1.13.19
- Critical9.8Unauthenticated Arbitrary File Upload
Product Input Fields for WooCommerce
≤2.0.1Update to 2.0.2
- High8.1Unauthenticated Local File Inclusion
Geo Mashup
≤1.13.18Update to 1.13.19
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.30.26Update to 10.30.27
- Medium5.3Unauthenticated Information Exposure
REST API Log
≤1.7.1Update to 1.7.2
- Medium4.3Missing Authorization
Duplicate Post
≤1.5.4Update to 1.5.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
AfterShip Tracking – All-In-One WooCommerce Order Tracking (Free plan available)
≤1.18.1Update to 1.18.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute
Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ
≤3.1.8Update to 3.1.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
WPJAM Basic
≤7.0.2.1Update to 7.0.3
- Critical9.8Unauthenticated REST API Authorization Bypass to Privilege Escalation
CheckView – Form & Checkout Testing
≤2.3.1Update to 2.3.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Profile Extra Fields by BestWebSoft
≤1.3.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP-Stats
≤2.56Update to 2.56.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Autopay
≤5.0.0Update to 5.0.1
- High7.5Unauthenticated SQL Injection
Active Woot Products Tables for WooCommerce. 100% FREE
≤1.1.1Update to 2.1.2
- High7.5Unauthenticated SQL Injection
RealPress – Real Estate Plugin
≤1.1.4Update to 1.1.5
- Medium5.3Missing Authorization
SOOZ – AI for SEO – Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot)
≤2.4.2Update to 2.4.3
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.1Update to 4.9.2