Database
WordPress Vulnerability Database (page 180)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Real IP-based Access Control
≤1.3.1No patch available
- Medium5.3Unauthenticated Payment Bypass
Quick PayPal Payments: Payment Button & Form
<5.7.51Update to 5.7.51
- Medium5.3Missing Authorization
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
≤1.9.0Update to 2.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Saitama Addon Pack
<1.0.9Update to 1.0.9
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.79Update to 5.5.80
- Medium5.3Missing Authorization
Simple Membership
≤4.7.8Update to 4.7.9
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Login & Register Customizer – Forms, Popup, Profile & WooCommerce
≤4.0.1Update to 4.0.2
- Medium5.3Missing Authorization
Legal Text Connector of the IT-Recht Kanzlei
≤1.0.13Update to 1.0.14
- High7.3Privilege Escalation to Unauthenticated Arbitrary Password Reset
FoodBoxBooker
≤1.0.6Update to 1.0.7
- Medium4.7Reflected Cross-Site Scripting via REQUEST_URI Query String
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
≤6.11.3Update to 6.11.4
- Critical9.1Missing Authorization
Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress
≤2.3.0Update to 2.4.0
- Medium6.5Authenticated (Author+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤3.9.1Update to 3.10.0
- Medium4.9Authenticated (Administrator+) SQL Injection
WP TripAdvisor Review Slider
≤14.3Update to 14.4
- Medium4.9Authenticated (Administrator+) SQL Injection via 'order' Parameter
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.7.9Update to 5.7.10
- High8.1Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action
Mailmunch Forms for Mailchimp
≤3.2.7Update to 3.2.8
- High7.5Unauthenticated Arbitrary File Deletion via Path Traversal
Contact Form Extender for Divi – Submissions DB & Extra Fields
≤1.0.6Update to 1.0.7
- High7.2Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤3.3.7Update to 3.3.8
- Medium6.5Insecure Direct Object Reference
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5.2Update to 4.5.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
Xpro Addons — 150+ Widgets for Elementor
≤1.5.1Update to 1.5.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
User Access Manager
≤2.3.12Update to 2.3.13
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
Udimi Tools
≤3.2Update to 3.2.1
- High7.5Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter
TableOn – WordPress Posts Table Filterable
≤1.0.5.1Update to 1.0.6
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Media Deletion
Multi Uploader for Gravity Forms
≤1.1.8Update to 1.1.9
- High7.3Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion
Material Dashboard
≤1.4.10Update to 1.4.11
- Medium6.1Reflected Cross-Site Scripting
Seraphinite Accelerator
≤2.29.18Update to 2.29.19
- Medium6.1Reflected Cross-Site Scripting
TranslatePress – Translate Multilingual sites with AI Translation
≤3.2.5Update to 3.2.6
- High8.8Authenticated (Author+) Arbitrary File Upload
LightSync Pro – Connect & Sync Cloud Assets | Lightroom, Canva, Figma, Dropbox & Shutterstock
≤2.1.6Update to 2.1.7
- High7.5Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API
Page and Post Restriction
≤1.4.1Update to 1.4.2
- High8.2Missing Authorization
WPFormify – Stripe Payments with Form and Checkout
≤1.1.1Update to 1.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SKT Skill Bar
≤2.6Update to 2.7