Database
WordPress Vulnerability Database (page 176)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
ReactPress
≤3.4.0Update to 3.4.1
- High8.8Authenticated (Outlet Manager+) Privilege Escalation
Vitepos
≤3.5.0Update to 3.6.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10Update to 1.10.0.1
- Medium4.9Authenticated (Administrator+) SQL Injection
Vitepos
≤3.5.0Update to 3.6.0
- Medium5.3Missing Authorization
SMEPay: UPI Gateway for WooCommerce
≤1.0.5No patch available
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API
Stream – Activity Log & Audit Trail
≤4.2.0Update to 4.2.1
- Critical9.8Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
TrueBooker – Appointment Booking and Scheduler System
≤1.2.3Update to 1.2.4
- Critical9.8Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
TrueBooker – Appointment Booking and Scheduler System
≤1.2.3Update to 1.2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
Ultra Addons for Contact Form 7
≤3.5.43Update to 3.5.44
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.69Update to 1.2.70
- Medium5.3Unauthenticated SMTP Header Injection
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.3.15Update to 8.3.16
- Medium5.3Unauthenticated Information Exposure
Featured Video Plus
≤2.3.3No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
login-social
≤1.0.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Houzez Property Feed
≤2.5.48Update to 2.5.49
- High8.1Lawyer WordPress Theme <= 1.18 - Unauthenticated PHP Object Injection
Abogado - Lawyer WordPress Theme
≤1.18No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Survey Maker by AYS
≤5.2.3.3Update to 5.2.3.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤8.5.0Update to 8.5.1
- Medium5.3Unauthenticated Sensitive File Disclosure
Contact Form to Any API
≤3.0.6Update to 3.0.7
- High8.8Authenticated (Author+) Arbitrary File Upload
Squeeze – Browser-Based Image Compression & WebP Converter (No API, No Limits)
≤1.7.11Update to 1.7.12
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Advanced Excerpt
≤4.4Update to 4.5
- High8.1Unauthenticated PHP Object Injection
Agora — Event & Conference WordPress Theme
≤1.9No patch available
- High8.1Unauthenticated PHP Object Injection
A.Williams
≤1.3.1No patch available
- Medium5.3Unauthenticated Information Exposure
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.9.2Update to 2.9.3
- High8.1Unauthenticated PHP Object Injection
ChamaWP – Monetize With Donations, Memberships, Crowdfunding, Commissions & Restricted Content
<1.0.13Update to 1.0.13
- Medium5.3Missing Authorization to Unauthenticated Google Calendar Connection Hijack
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
<10.31.3Update to 10.31.3
- High8.1AI Generator & AI Agency WordPress Theme <= 1.29.0 - Unauthenticated PHP Object Injection
AI ANN - AI Generator & AI Agency WordPress Theme
≤1.29.0No patch available
- Medium4.3Missing Authorization
Customer Reviews for WooCommerce
≤5.115.0Update to 5.116.0
- Medium5.3Unauthenticated Privilege Escalation
AutoNetTV Relay
≤3.0.13Update to 3.0.14
- Medium4.3Cross-Site Request Forgery
Theme My Login
≤7.1.14Update to 7.1.15
- High7.5Unauthenticated SQL Injection
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
<10.11.1Update to 10.11.1