Database
WordPress Vulnerability Database (page 189)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Price Manipulation
WPC Name Your Price for WooCommerce
≤2.2.4Update to 2.2.5
- Medium5.3Missing Authorization to Unauthenticated Unauthorized Form Submission
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
<3.1.2Update to 3.1.2
- High7.2Unauthenticated Server-Side Request Forgery
Newsletters
≤4.15Update to 4.16
- Medium4.3Missing Authorization
Tutor LMS – eLearning and online course solution
<4.0.0Update to 4.0.0
- Medium4.3Missing Authorization
Sync Post With Other Site
<1.9.3Update to 1.9.3
- Medium4.3Missing Authorization
Search Atlas SEO – OTTO AI SEO Automation for WordPress
<2.6.12Update to 2.6.12
- Low3.1Two-Factor Authentication Bypass via Brute Force
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤6.2.7Update to 6.2.8
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
WP Travel – Ultimate Travel Booking System, Tour Management Engine
<11.8.1Update to 11.8.1
- Medium4.3Authenticated (Subscriber+) Information Exposure
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<10.0.10Update to 10.0.10
- Medium5.3Missing Authorization
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
<1.10.2Update to 1.10.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<6.0.9.4Update to 6.0.9.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
HBook - Hotel booking system - WordPress Plugin
≤2.1.9Update to 2.1.10
- High7.2Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
Subscriptions for WooCommerce
≤2.0.0Update to 2.0.1
- Critical9.8Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key
Admin and Site Enhancements (ASE) Pro
≤8.9.0Update to 8.9.1
- High7.5Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
BuddyPress
≤14.5.0No patch available
- High8.8Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint
FleekDash V2
≤2.6.2.2Update to 2.6.2.5
- Medium6.5Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
Improved Save Button
≤1.2.1No patch available
- Medium5.3Unauthenticated Price Manipulation via ZarinPal Widget
المنتور فارسی
≤2.8.1Update to 2.8.2
- Medium5.3Missing Authorization
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.16.5Update to 3.16.6
- Medium5.3Unauthenticated Payment Bypass
Payment Gateway for Redsys & WooCommerce Lite
≤7.0.1Update to 7.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
≤1.2.78.0Update to 1.2.78.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Addons for Elementor
≤1.45.2Update to 1.45.2.1
- Medium4.3Two-Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤6.2.6Update to 6.2.7
- Medium5.3Unauthenticated Two-Factor Authentication Bypass
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤30.0.6Update to 30.0.7
- Medium4.3Authenticated (Subscriber+) Information Exposure
MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings
≤7.0.3Update to 7.0.4
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤3.1.2Update to 3.2.0
- Medium6.1Reflected Cross-Site Scripting
Link Library
<7.9.4Update to 7.9.4
- Medium4.3Authenticated (Customer+) Insecure Direct Object Reference
Colissimo shipping methods for WooCommerce
≤2.10.0Update to 3.0.0
- Medium4.3Missing Authorization
AnsPress – Question and answer
4.4.4 – 4.4.4No patch available
- Medium4.3Authenticated (Contributor+) Information Exposure
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.8Update to 3.7.8.1