Database
WordPress Vulnerability Database (page 192)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Insecure Direct Object Reference
Formidable Forms Signature Online Contract Automation
≤2.0.1Update to 2.0.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
≤3.8.1Update to 3.8.2
- Medium5.3Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.5.9Update to 8.6.0
- Medium5.3Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.5.9Update to 8.6.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
≤2.1.0Update to 2.1.1
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
≤2.1.0Update to 2.1.1
- High7.5Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.3.2Update to 7.4.0
- Medium4.9Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
Tutor LMS – eLearning and online course solution
≤4.0.1Update to 4.0.2
- Medium5.3Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
≤2.1.0Update to 2.1.1
- Medium5.0Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
Shortcodify
≤1.4.3No patch available
- High7.5Unauthenticated SQL Injection via 'id' Parameter
PickPlugins Question Answer
≤1.2.73No patch available
- High7.5Unauthenticated SQL Injection
Web Directory plugin Free – AI powered
≤1.7.13Update to 2.0
- High8.8Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint
Eazy Plugin Manager
≤4.4.1Update to 4.5.0
- Medium4.9Authenticated (Administrator+) Arbitrary File Read
SpeedyCache – Cache, Optimization, Performance
≤1.3.8Update to 1.3.9
- Medium4.1Authenticated (Administrator+) Server-Side Request Forgery
Media Cleaner: Delete Unused Images & Clean Your Media Library
≤7.0.3Update to 7.0.6
- Medium6.5Authenticated (Subscriber+) SQL Injection
Plugin Organizer
≤10.2.4Update to 10.2.5
- Medium6.5Authenticated (Subscriber+) SQL Injection
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤5.0.9Update to 6.0.0
- High7.5Unauthenticated SQL Injection
TrueBooker – Appointment Booking and Scheduler System
≤1.2.2Update to 1.2.3
- High7.5Unauthenticated SQL Injection
Online Scheduling and Appointment Booking System – Bookly
≤27.7Update to 27.8
- High7.5Unauthenticated SQL Injection
Premium Packages – Sell Digital Products Securely
≤6.2.0Update to 7.0.0
- High7.5Unauthenticated SQL Injection
WP Fast Total Search – The Power of Indexed Search
≤1.80.280Update to 1.81.282
- High8.8Authenticated (Subscriber+) Privilege Escalation
Teydea Login Security – Password Policy, Complexity Rules & Expiration
≤3.7.1Update to 3.7.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.7Update to 3.9.8
- Medium4.4Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.7Update to 3.9.8
- Critical9.8Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.7Update to 3.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.9.9.1Update to 7.9.9.2
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤3.4.5Update to 3.4.6
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤3.4.5Update to 3.4.6
- Medium5.3Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter
PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer
≤1.1.0Update to 1.1.1
- Medium5.3Unauthenticated Information Exposure to Arbitrary Directory Copy
Demi – One Click Demo Import, Backup & Site Migration
≤0.0.8Update to 0.0.9