Database
WordPress Vulnerability Database (page 19)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer
Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance
≤1.7No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters
Mobile builder
≤1.4.2No patch available
- High8.8Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
Import and export users and customers
≤2.5.11Update to 2.5.12
- High7.2Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field
Slim Jetpack
≤2.7.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.3Update to 1.44.4
- Medium6.5Authenticated (Author+) SQL Injection
CatFolders – WordPress Media Library Folders & Categories
≤2.5.6Update to 2.5.7
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- High7.5Unauthenticated SQL Injection
Mail Mage
≤0.0.25No patch available
- Medium4.3Authenticated (Vendor+) Business Logic Flaw
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium6.3Authenticated (Contributor+) Privilege Escalation
Surfer – WordPress Plugin
≤1.8.1.758Update to 1.8.1.759
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ShopEngine Gutenberg WooCommerce Builder Blocks Addon – All in One WooCommerce Solution
≤2.4.3Update to 2.4.4
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Cool Media Filter
≤1.0.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
≤3.13.6Update to 3.13.7
- Medium4.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- Medium5.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- Medium5.3Missing Authorization
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.7.1Update to 8.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Posts Table with Search & Sort
≤1.4.14Update to 1.4.15
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤5.0.0Update to 5.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.1.3Update to 3.1.4
- Medium5.3Missing Authorization
ClickCease Click Fraud Protection
≤3.3.0Update to 3.3.1
- Medium5.3Missing Authorization
Better Search – Relevant search results for WordPress
≤4.5.2Update to 4.5.3
- Medium5.3Missing Authorization
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium5.3Missing Authorization
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium5.3Missing Authorization
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤5.0.0Update to 5.1.0
- Critical9.8Unauthenticated Remote Code Execution
WP Libre Form
≤1.5.0.1No patch available
- High8.1Authenticated (Accounting Manager+) Arbitrary File Deletion
Ever Accounting – Accounting & Invoicing Solution for Small Businesses
≤2.3.2Update to 2.3.3
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.3Update to 1.58.4
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.3Update to 1.58.4
- Critical9.8Unauthenticated Remote Code Execution
Static Snapshot
≤0.2.1No patch available