Database
WordPress Vulnerability Database (page 191)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
Newsletters
≤4.15Update to 4.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Newsletters
≤4.15Update to 4.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute
WowStore – Store Builder & Product Blocks for WooCommerce
≤4.4.24Update to 4.5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute
WowStore – Store Builder & Product Blocks for WooCommerce
≤4.4.24Update to 4.5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.11Update to 2.2.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Share, Social Login and Social Comments Plugin – Super Socializer
≤7.14.5No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.24Update to 6.4.25
- High8.8Authenticated (Contributor+) Remote Code Execution
Betheme
≤28.5.7Update to 28.5.8
- Medium5.3Missing Authorization
Social Share, Social Login and Social Comments Plugin – Super Socializer
≤7.14.5No patch available
- Medium5.3Missing Authorization
Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder
≤3.0.5Update to 3.0.7
- High7.5Unauthenticated SQL Injection
Simply Schedule Appointments
≤1.6.12.10Update to 1.6.12.11
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Pricing Configuration Modification and Coupon Code Disclosure
YayPricing – WooCommerce Dynamic Pricing & Discounts
≤3.5.6Update to 3.5.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy PayPal & Stripe Buy Now Button
≤2.0.4Update to 2.0.5
- High7.5Authenticated (Author+) PHP Object Injection
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
≤3.2.10Update to 3.2.11
- Medium4.3Authenticated (Subscriber+) Information Exposure
Vimeo
≤1.2.2No patch available
- Medium5.3Missing Authorization
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.7.13Update to 8.7.14
- High7.5Unauthenticated SQL Injection
WP OAuth Server ( Login with WordPress )
≤6.2.0Update to 6.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.6.8Update to 3.6.9
- Medium5.3Missing Authorization
Staff Training
≤1.0.7No patch available
- Medium5.3Missing Authorization
BOX NOW Delivery Croatia + Slovenia
≤3.3.0Update to 3.3.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
Creative Mail – Easier WordPress & WooCommerce Email Marketing
≤1.6.9No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Simply Schedule Appointments
≤1.6.12.10Update to 1.6.12.11
- High7.2Unauthenticated Stored Cross-Site Scripting
wpDataTables (Premium)
≤7.5.1Update to 7.5.2
- Medium5.3Missing Authorization
Breakdance
≤2.6.1Update to 2.6.2
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.109Update to 2.8.110
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Zportals
≤6.3.3Update to 6.3.4
- High7.5Authenticated (Subscriber+) PHP Object Injection
Export User Data
≤2.2.6No patch available
- High7.5Unauthenticated SQL Injection
Qode Tours
≤3.1.3.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
AffiliateWP
≤2.35.0Update to 2.35.1
- Critical9.8Unauthenticated Privilege Escalation
AI Copilot – Content Generator
≤1.5.6Update to 1.5.8