Database
WordPress Vulnerability Database (page 188)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization to Unauthenticated License Deactivation
Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps
≤1.0.13No patch available
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Auto Featured Image (Auto Post Thumbnail)
≤5.0.4Update to 5.0.5
- Medium6.1Reflected Cross-Site Scripting
GEO Plugin by Squirrly SEO
≤14.2.0Update to 14.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Meta pixel for WordPress
≤5.2.1Update to 5.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Slick Slider
≤0.5.2Update to 0.5.3
- Medium5.3Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.8Update to 6.2.9
- Medium5.3Missing Authorization to Unauthenticated Contact Updates
MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
≤1.5.0Update to 1.5.1
- Critical9.8Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command
Realtyna Organic IDX plugin + WPL Real Estate
≤5.3.0Update to 5.4.0
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Realtyna Organic IDX plugin + WPL Real Estate
≤5.3.0Update to 5.4.0
- Medium5.3Missing Authorization
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤8.5.1Update to 8.5.2
- Medium5.3Missing Authorization
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<6.6.10Update to 6.6.10
- Medium4.3Authenticated (Subscriber+) Information Exposure
Easy Appointments
<3.12.28Update to 3.12.28
- Medium5.3Unauthenticated Pending Upload Disclosure
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.3Update to 7.4
- Medium5.3Unauthenticated Information Exposure
Tour Master - Tour Booking, Travel, Hotel
≤5.4.8Update to 5.4.9
- Medium6.5Authenticated (Custom role+) SQL Injection
WP Hotel Booking
<2.3.2Update to 2.3.2
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Easy Appointments
<3.12.28Update to 3.12.28
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
<6.2.6Update to 6.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Animation Addons – Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates
<2.7.0Update to 2.7.0
- Medium5.3Missing Authorization
ProfileGrid – User Profiles, Groups and Communities
≤5.0.0.0Update to 6.0.0.0
- Medium4.3Missing Authorization
Easy Appointments
<4.0.1Update to 4.0.1
- Medium5.3Missing Authorization
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<6.0.9.4Update to 6.0.9.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<6.6.10Update to 6.6.10
- Medium6.4Authenticated (Custom role+) Stored Cross-Site Scripting
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
≤10.0.9Update to 10.0.10
- Medium6.4Authenticated (Custom role+) Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<4.16.3Update to 4.16.3
- Medium5.3Unauthenticated Mail Relay
Estatik Real Estate Plugin
≤4.3.2Update to 4.3.3
- Low2.7Authenticated (Editor+) Information Exposure
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.6.3Update to 3.6.4
- Medium4.3Missing Authorization
Easy Appointments
<3.12.28Update to 3.12.28
- Critical9.1Unauthenticated Arbitrary File Deletion
Drag and Drop Multiple File Upload for WooCommerce
≤1.1.7Update to 1.1.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
≤1.5.0Update to 1.5.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Easy Appointments
<3.12.28Update to 3.12.28