Database
WordPress Vulnerability Database (page 185)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
≤3.7.0Update to 3.7.1
- High7.5Unauthenticated SQL Injection
Iptanus File Upload
≤5.1.7Update to 5.1.8
- Medium5.3Missing Authorization
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.78Update to 5.5.79
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.6.5Update to 3.6.6
- Medium4.3Missing Authorization
Clever Mega Menu for Visual Composer
≤1.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetEngine
<3.8.12Update to 3.8.12
- High7.5Authenticated (Contributor+) PHP Object Injection
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
<5.3.7Update to 5.3.7
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Meta Box – A Framework for Dynamic Websites
<5.13.1Update to 5.13.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
<8.7.13Update to 8.7.13
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
ProfileGrid – User Profiles, Groups and Communities
<5.9.9.8Update to 5.9.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Narrative Publisher
≤1.0.7No patch available
- Medium4.3Missing Authorization
LWS Optimize – All-in-One Speed Booster & Cache Tools
<3.4Update to 3.4
- Medium4.3Cross-Site Request Forgery
Frontend File Manager Plugin
≤23.6No patch available
- Medium4.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
<5.3.7Update to 5.3.7
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
<1.95.3Update to 1.95.3
- Medium4.3Missing Authorization
Five Star Restaurant Reservations – WordPress Booking Plugin
<2.7.23Update to 2.7.23
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
<1.8.5.3Update to 1.8.5.3
- Medium5.3Unauthenticated Information Exposure
Product Attachment for WooCommerce
<2.3.3Update to 2.3.3
- Critical9.8Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
WooCommerce - Social Login
≤2.8.7Update to 2.8.8
- High7.5Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
User Access Manager
≤2.3.15Update to 2.3.16
- High7.5Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
CubeWP Framework
≤1.1.30Update to 1.1.31
- Medium5.3Missing Authorization
Event Tickets and Registration
<5.29.0.1Update to 5.29.0.1
- Medium5.3Missing Authorization
Pixelavo – Server Side Tracking & Pixel + AI Ads Tools
<1.5.4Update to 1.5.4
- Medium5.3Unauthenticated Information Exposure
JetReviews
≤3.0.1Update to 3.1.0
- Medium4.3Cross-Site Request Forgery
Podlove Podcast Publisher
<4.5.3Update to 4.5.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Codeless Page Builder
≤1.1.4No patch available
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Tickets and Registration
<5.29.0.1Update to 5.29.0.1
- Medium4.3Authenticated (Contributor+) Information Exposure
Brizy – Page Builder
<2.8.18Update to 2.8.18
- Medium5.3Unauthenticated Information Exposure
JetBlocks for Elementor
≤1.5.0Update to 1.5.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Admin Columns for ACF Fields
<0.3.3.1Update to 0.3.3.1