Database
WordPress Vulnerability Database (page 183)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Detail Disclosure
Subscriptions for WooCommerce
≤2.0.0Update to 2.0.1
- Medium4.3Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium5.3Unauthenticated User Data Disclosure
Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
≤1.3.0Update to 1.4.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
SEO Redirection Plugin – 301 Redirect Manager
≤9.18Update to 9.19
- Medium5.3Unauthenticated Pending/Draft Listing Disclosure
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.168Update to 2.8.169
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
≤5.0.1Update to 5.0.2
- Medium4.3Missing Authorization
Unlimited Elements for Elementor
≤2.0.15Update to 2.0.16
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Order and Customer PII Disclosure
MStore API – Create Native Android & iOS Apps On The Cloud
≤4.20.0Update to 4.21.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.56.0Update to 1.56.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
YMC Filter
≤3.12.8Update to 3.12.9
- Medium4.3Cross-Site Request Forgery
Estatik Real Estate Plugin
≤4.3.2Update to 4.3.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium4.3Authenticated (Subscriber+) Payment Bypass
WP Events Manager
≤2.2.4Update to 2.2.5
- Medium4.3Authenticated (Subscriber+) Contact Message and User Data Disclosure
WP Directory Kit
≤1.5.4Update to 1.5.5
- High8.1Unauthenticated Local File Inclusion
WP Maps Pro
≤6.1.2Update to 6.1.3
- Medium5.3Missing Authorization
MStore API – Create Native Android & iOS Apps On The Cloud
≤4.20.0Update to 4.21.0
- Medium6.1Reflected Cross-Site Scripting
Link Library
≤7.9.3Update to 7.9.4
- Medium5.3Insecure Direct Object Reference to Unauthenticated Payment Bypass
WP Events Manager
≤2.2.4Update to 2.2.5
- Medium5.3Unauthenticated Export ZIP File Deletion
WP Photo Album Plus
≤9.2.07.1Update to 9.2.07.002
- High8.1Unauthenticated PHP Object Injection
Remote API
≤0.2No patch available
- High7.5Unauthenticated SQL Injection
Online Scheduling and Appointment Booking System – Bookly
<27.8Update to 27.8
- Medium5.3Unauthenticated Information Exposure
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤6.3.0Update to 6.4.0
- Medium5.3Missing Authorization
MStore API – Create Native Android & iOS Apps On The Cloud
≤4.20.0Update to 4.21.0
- High8.1Unauthenticated PHP Object Injection
Ajax Search Lite – Live Search & Filter
≤4.14.4Update to 4.14.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
BNE Testimonials
≤2.0.8.1Update to 2.0.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
EmbedPress
≤4.5.6Update to 4.6.0
- Medium4.3Cross-Site Request Forgery
Google Authenticator
≤0.55Update to 0.56
- Medium5.3Unauthenticated Information Exposure
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤6.3.0Update to 6.4.0
- Medium5.3Missing Authorization
PiWeb Cancel order / Refund request for WooCommerce
≤1.3.4.33Update to 1.3.4.34
- High7.3Unauthenticated API Authorization Bypass via Type Juggling
Newsletters
≤4.15Update to 4.16