Database
WordPress Vulnerability Database (page 184)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Information Exposure
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.9Update to 14.16.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YMC Filter
≤3.12.7Update to 3.12.8
- High7.5Authenticated (Subscriber+) Local File Inclusion
Wp Maps
≤4.9.6Update to 4.9.7
- Medium4.3Missing Authorization
Solace Extra
≤1.6.0Update to 1.6.1
- Medium5.3Unauthenticated CAPTCHA Bypass
Simple CAPTCHA with Cloudflare Turnstile
≤1.41.0Update to 1.42.0
- Medium6.5Authenticated (Subscriber+) Denial of Service
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.6Update to 4.9.7
- Medium5.3Missing Authorization
Download Monitor
≤5.2.5Update to 5.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.2.3Update to 4.2.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)
≤4.4Update to 4.5
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.13.1Update to 3.8.13.2
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
Passster – Password Protect Pages and Content
≤4.3.6Update to 4.3.7
- Medium4.3Payment Bypass to Authenticated (Contributor+) Stored CSS Injection
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
≤5.0.1Update to 5.0.2
- Medium6.5Authenticated (Contributor+) Arbitrary File Download
Unlimited Elements for Elementor
≤2.0.14Update to 2.0.15
- Medium5.3Unauthenticated Information Exposure
Password Protected
≤2.8.3Update to 2.8.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Meow Gallery
≤5.5.1Update to 5.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Comments
≤7.6.59Update to 7.6.60
- Medium5.3Information Exposure to Unauthenticated Order Data Disclosure
WPC Order Tip for WooCommerce
≤3.3.0Update to 3.3.1
- High8.1Unauthenticated PHP Object Injection
Newsletters
≤4.15Update to 4.16
- Critical9.8Remote Code Execution via Backdoor
Fluent Forms Pro Add On Pack
6.2.7 – 6.2.7Update to 6.2.8
- High7.5Unauthenticated SQL Injection
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium4.3Missing Authorization
Solace Extra
≤1.6.0Update to 1.6.1
- High8.8Authenticated (Contributor+) Privilege Escalation
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.56.0Update to 1.56.0.1
- Medium5.3Unauthenticated Price Manipulation
Appointment Hour Booking – Booking Calendar
≤1.5.87Update to 1.5.88
- Medium4.3Missing Authorization
Church Admin
≤5.0.30Update to 5.1.0
- Medium4.7Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation
Subscriptions for WooCommerce
≤2.0.0Update to 2.0.1
- Medium4.7Unauthenticated Open Redirect
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
≤2.4.2Update to 2.4.3
- Medium5.3Unauthenticated Payment Verification Bypass
Subscriptions for WooCommerce
≤2.0.0Update to 2.0.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
MotoPress Hotel Booking
<6.0.4Update to 6.0.4
- Medium6.1Reflected Cross-Site Scripting
Subscribe2 – Form, Email Subscribers & Newsletters
≤10.45Update to 10.46
- Medium5.3Insecure Direct Object Reference to Unauthenticated Cross-Session Chatbot File Deletion
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.6.3Update to 3.6.4