Database
WordPress Vulnerability Database (page 190)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Easy Appointments
<3.12.28Update to 3.12.28
- Medium4.3Two-Factor Authentication Bypass
WP 2FA – Two-factor authentication for WordPress
≤4.0.0Update to 4.1.0
- Critical9.8Unauthenticated Remote Code Execution
Spider Analyser – WordPress搜索引擎蜘蛛分析插件
≤2.1.3No patch available
- Medium5.3Insecure Direct Object Reference to Unauthenticated Image Attachment Disclosure
PeproDev Receipt Uploader for WooCommerce
≤2.14.0Update to 2.15.0
- Medium5.3Insecure Direct Object Reference to Unauthenticated Order Receipt Tampering
PeproDev Receipt Uploader for WooCommerce
≤2.14.0Update to 2.15.0
- High7.5Unauthenticated SQL Injection
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
≤8.0.0Update to 8.0.1
- Medium4.3Missing Authorization
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.10Update to 5.0.11
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings
Extra Checkout Options - addon for Extra Product Options plugin
≤2.3.2Update to 2.3.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Booking System Trafft
≤1.0.17Update to 1.0.18
- High7.2Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
Advanced Shipment Tracking for WooCommerce
≤3.9Update to 3.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute
WPC Badge Management for WooCommerce
≤3.1.6Update to 3.1.7
- Medium6.5Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.23Update to 3.7.24
- Medium4.3Cross-Site Request Forgery to Sync Rule Status Toggle
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)
≤1.1.24.2Update to 1.1.25.2
- Medium4.9Authenticated (Administrator+) Server-Side Request Forgery
WP CTA – Call Now Button, Sticky Button & Call to Action Builder
2.1.2 – 2.1.2Update to 2.1.3
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update
Klubraum Membership Request
≤1.1.0Update to 1.1.1
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter
Meta Box AIO
≤3.8.0Update to 3.9.0
- Critical9.8Unauthenticated Remote Code Execution via 'orderDetails' Parameter
Cost Calculator Builder PRO
≤4.0.3Update to 4.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Name Field Nested password Member
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.7Update to 6.2.8
- High7.2Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress
≤1.22.3Update to 1.22.4
- Critical9.8Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
≤2.4.37No patch available
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
Facturación Electrónica Costa Rica
≤2.0.4Update to 2.0.5
- Medium4.9Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter
WP-Lister Lite for eBay
≤3.8.8Update to 3.8.9
- High7.2Unauthenticated Stored Cross-Site Scripting via Array Form Field Values
Database for CF7
≤1.2.6No patch available
- Critical9.810.8.8 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …
≤10.8.8Update to 10.9.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export
Survey Form Block
≤1.0.1Update to 1.0.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'table' Parameter
WP Photo Album Plus
≤9.2.04.002Update to 9.2.04.003
- High7.2Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.6.9Update to 3.6.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta
Contact Form to Any API
≤3.0.6Update to 3.0.7
- High8.8Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
Wholesale for WooCommerce – Ultimate AI-Powered B2B Ecommerce Solution – Bulk Order Form, Quotes, & More
≤2.0.5Update to 2.0.6
- Medium4.3Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.3.7Update to 5.3.8