Database
WordPress Vulnerability Database (page 182)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Media Library Assistant
≤3.38Update to 3.39
- High7.5Unauthenticated SQL Injection
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<10.1.04Update to 10.1.04
- High7.2Unauthenticated Stored Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.2Update to 7.4.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Thrive Visual Editor
≤10.9.3.1Update to 10.9.3.2
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
File Manager
≤6.9.0Update to 6.9.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Advanced AJAX Product Filters
≤3.2.0.3Update to 3.2.1
- Medium5.3Unauthenticated Payment Bypass
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.16Update to 4.1.16
- Medium5.3IP Spoofing to Protection Mechanism Bypass
Hide My WP Ghost – Security & Firewall
<7.0.05Update to 7.0.05
- High8.1Unauthenticated PHP Object Injection
Ajax Search Lite – Live Search & Filter
≤4.14.4Update to 4.14.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤5.2.9Update to 5.2.10
- Medium5.3Unauthenticated Payment Bypass
WP Travel – Ultimate Travel Booking System, Tour Management Engine
<11.8.1Update to 11.8.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
JS Help Desk – AI-Powered Support & Ticketing System
<3.1.4Update to 3.1.4
- High7.2Authenticated (Admin+) Remote Code Execution
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
<3.10.01Update to 3.10.01
- Medium5.3Missing Authorization
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.4.1Update to 3.6.4.2
- High8.1Unauthenticated PHP Object Injection
Kirki – Freeform Page Builder, Website Builder & Customizer
<6.0.13Update to 6.0.13
- Critical9.8Unauthenticated Privilege Escalation via Password Reset
Bricksforge
≤3.1.8.7Update to 3.1.8.8
- High7.5Freelance Designer WordPress <= 1.3 - Authenticated (Subscriber+) PHP Object Injection
ColorFolio
≤1.3No patch available
- Medium5.3Unauthenticated File Activity Log Disclosure
File Manager
≤6.9.0Update to 6.9.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
CubeWP Framework
≤1.1.30Update to 1.1.31
- Medium5.3Unauthenticated Payment Bypass
FlxWoo
<3.1.1Update to 3.1.1
- Medium5.3Unauthenticated Payment Bypass
GiveWP – Donation Plugin and Fundraising Platform
<4.16.3Update to 4.16.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Meta Disclosure
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
≤4.9.10Update to 4.9.11
- Medium4.3Authenticated (Subscriber+) Plugin Settings and API Key Disclosure
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium5.3Unauthenticated Information Exposure
Create
≤2.5.3Update to 2.5.4
- Medium4.3Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Downloadable Product Access Grant
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.10Update to 5.0.11
- High7.5Unauthenticated SQL Injection
WPCargo Track & Trace
≤8.0.3Update to 8.0.4
- Medium5.3Unauthenticated Information Exposure
Create
≤2.5.3Update to 2.5.4
- High7.5Unauthenticated Denial of Service
WP Maps Pro
≤6.1.2Update to 6.1.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Detail Disclosure
Subscriptions for WooCommerce
≤2.0.0Update to 2.0.1
- Medium4.3Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure
WP Directory Kit
≤1.5.4Update to 1.5.5