Database
WordPress Vulnerability Database (page 179)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization to Unauthenticated Settings Update
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
<6.8.2Update to 6.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WPIDE – File Manager & Code Editor
≤3.5.7Update to 3.5.8
- Critical9.8Unauthenticated Arbitrary Password Reset to Account Takeover
Single Sign On For TNG
≤2.1.0Update to 2.2.0
- Critical9.8Unauthenticated Privilege Escalation
ACF Frontend Admin by DynamiApps
≤3.29.12Update to 3.29.13
- Medium5.3Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
Arvow AI SEO Writer
≤1.5.3Update to 1.5.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Dynamic Pricing With Discount Rules for WooCommerce
<5.0.0Update to 5.0.0
- High8.1Unauthenticated Account Takeover via Brute Force Password Reset Code
Login & Register Customizer – Forms, Popup, Profile & WooCommerce
≤4.0.1Update to 4.0.2
- Medium4.3Missing Authorization
ACF Frontend Admin by DynamiApps
<3.29.7Update to 3.29.7
- Medium5.3Unauthenticated Payment Bypass
Payment Button for PayPal
<1.2.3.45Update to 1.2.3.45
- Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
<5.0.11Update to 5.0.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Powerkit – Supercharge your WordPress Site
≤3.1.0Update to 3.1.1
- Medium4.3Unauthenticated Payment Bypass
Accept PayPal & Stripe with Subscriptions for WooCommerce
<3.1.1Update to 3.1.1
- High7.2Authenticated (Shop Manager+) Privilege Escalation
Order Delivery Date for WooCommerce
≤4.6.0Update to 4.6.1
- Medium4.3Missing Authorization
ACF Frontend Admin by DynamiApps
≤3.29.10Update to 3.29.11
- High8.1Unauthenticated Local File Inclusion
E2Pdf – Export Pdf Tool for WordPress
≤1.32.40Update to 1.32.43
- High8.1Unauthenticated PHP Object Injection
WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection
≤3.1.43Update to 3.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.23.0Update to 1.24.0
- Medium4.4Authenticated (Shop manager+) Stored Cross-Site Scripting
FiboSearch – Ajax Search for WooCommerce
≤1.33.0Update to 1.34.0
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post and User Meta Disclosure
CubeWP Framework
≤1.1.30No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Type Hub
≤2.0.6No patch available
- Medium5.3Unauthenticated Payment Verification Bypass
Accept PayPal & Stripe with Subscriptions for WooCommerce
≤3.1.2Update to 4.0.0
- Medium5.3Unauthenticated Registered User Email Address Disclosure
Login & Register Customizer – Forms, Popup, Profile & WooCommerce
≤4.0.1Update to 4.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.13.0Update to 3.8.13.1
- Medium5.3Unauthenticated Information Exposure
YITH WooCommerce Product Gallery & Image Zoom
≤2.52.0Update to 2.52.1
- Medium5.3Missing Authorization
Direct Payments for WooCommerce – Bank Transfer, Mobile Money, Crypto and Peer-to-Peer (P2P) Payments
<2.5.3Update to 2.5.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification
<2.10.1Update to 2.10.1
- High7.5Unauthenticated SQL Injection
Participants Database
<2.7.8.4Update to 2.7.8.4
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.9Update to 4.1.10
- Medium5.3Missing Authorization
Passster – Password Protect Pages and Content
<4.3.6Update to 4.3.6
- Medium4.3Cross-Site Request Forgery
Tracking Code Manager
≤2.6.0Update to 2.7.0