Database
WordPress Vulnerability Database (page 181)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Administrator+) OS Command Injection via 'file' Parameter
Backup Migration
≤2.1.1Update to 2.1.5.2
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
DTX – Dynamic Text Extension for Contact Form 7
≤5.0.5Update to 5.0.6
- Medium6.5Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
Layouts for WPBakery
≤1.1.3Update to 1.1.4
- High8.1Cross-Site Request Forgery
Search Analytics for WP – Site Search Tracking
≤1.4.16Update to 1.5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Simple Yearly Archive
≤2.2.4Update to 2.2.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter
Askeet — Talk to Your WooCommerce Data
≤3.0Update to 3.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting
Super Progressive Web Apps
≤2.2.43Update to 2.2.44
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure
AI Copilot – Content Generator
≤1.4.6Update to 1.4.19
- High7.5Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API
wiseCampaign – WooCommerce Side Cart, BOGO Discounts, Countdown Timer & Exit Intent Popup
≤1.1.16Update to 1.1.17
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
Cost Calculator Builder
≤3.6.17Update to 4.0.3
- Medium4.9Authenticated (Administrator+) SQL Injection via 's' Parameter
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
≤3.6.20Update to 3.6.21
- High8.1Authenticated (Author+) Arbitrary File Deletion
Content Egg – Affiliate Product Importer & Price Comparison
≤11.3.0Update to 11.4.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Relevanssi Premium
≤2.30.2Update to 2.30.3
- Medium6.1Authenticated (Subscriber+) Reflected Cross-Site Scripting
Football Pool
≤2.13.4Update to 2.13.5
- Medium6.5Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.4Update to 1.17.5
- Critical9.3Unauthenticated Password Reset Link Poisoning to Account Takeover
Membership Plugin – Kadence Memberships
≤4.0.0Update to 4.0.1
- High8.8Missing Authorization to Authenticated (Vendor+) Privilege Escalation
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.2Update to 5.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Independent Analytics – WordPress Analytics Plugin
≤2.15.0Update to 2.15.1
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentItems Flexible Rental Management System
≤1.2.1Update to 1.2.2
- High7.5Unauthenticated SQL Injection
VikAppointments Services Booking Calendar
≤1.2.19Update to 1.2.20
- High8.8Unauthenticated Privilege Escalation to Administrator
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.12.0Update to 1.13.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
<2.4.3Update to 2.4.3
- Critical9.8Unauthenticated Privilege Escalation
Kadence WooCommerce Email Designer
≤1.5.19Update to 1.5.19.1
- High7.2Unauthenticated Stored Cross-Site Scripting
NewStatPress
<1.4.5Update to 1.4.5
- High7.2Authenticated (Shop Manager+) Remote Code Execution
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤6.6.42Update to 6.6.43
- Medium4.3Authenticated (Subscriber+) Information Exposure
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.8.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
LWS Optimize – All-in-One Speed Booster & Cache Tools
≤4.1.1Update to 4.1.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
File Manager
≤6.9.0Update to 6.9.1
- High8.1Unauthenticated Administrator Account Takeover on Multi-Site
InfiniteWP Client
≤1.13.5Update to 1.13.6
- Medium5.3Missing Authorization
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
≤1.17.2Update to 1.17.3