Database
WordPress Vulnerability Database (page 193)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.1Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action
Demi – One Click Demo Import, Backup & Site Migration
≤0.0.7Update to 0.0.9
- Medium4.3Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.3.7Update to 4.3.8
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter
Chaty Pro
≤3.5.5Update to 3.5.6
- High7.2Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.19Update to 2.15.20
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function
Advanced Form Integration — Connect Forms to 300+ Apps
≤2.6.0Update to 2.7.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤30.0.6Update to 30.0.7
- Medium4.3Missing Authorization
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤30.0.6Update to 30.0.7
- Medium5.3Missing Authorization
Gillion | Multi-Concept Blog/Magazine & Shop WordPress AMP Theme
≤4.13Update to 4.14
- Medium5.3Missing Authorization
Ad Invalid Click Protector (AICP)
≤1.3.0Update to 1.3.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.18Update to 2.4.19
- Medium5.3Unauthenticated Information Exposure
Exclusive Addons for Elementor
≤2.8.0Update to 2.8.1
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.4Update to 5.2.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation
wpForo Forum
≤3.1.2Update to 3.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.1Update to 5.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Anti-Spam, Spam FireWall by CleanTalk
≤6.82Update to 6.83
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.6.11Update to 3.6.12
- High7.2Unauthenticated Stored Cross-Site Scripting
BackWPup – WordPress Backup & Restore Plugin
≤5.7.4Update to 5.7.5
- Medium5.3Missing Authorization
Thrive Leads
≤10.9.2Update to 10.9.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
≤3.1.0Update to 3.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Message Filter for Contact Form 7
≤1.6.3.9Update to 1.6.4.0
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Google Review Slider
≤18.4Update to 18.5
- Critical9.8Unauthenticated Arbitrary File Upload
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist
≤1.8.1Update to 1.8.2
- Medium4.3Missing Authorization
YayPricing – WooCommerce Dynamic Pricing & Discounts
≤3.5.6Update to 3.5.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Photonic Gallery & Lightbox for Flickr, SmugMug & Others
≤3.33Update to 3.34
- Medium4.3Cross-Site Request Forgery
Insert Headers and Footers Code – HT Script
≤1.1.8Update to 1.1.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Location Weather – WordPress Weather Forecast, Air Quality & Weather Widget
≤3.0.6Update to 3.0.7
- Medium6.4Page Builder <= 2.8.18 - Authenticated (Author+) Stored Cross-Site Scripting
Brizy – Page Builder
≤2.8.18Update to 2.8.19
- Medium5.3Missing Authorization
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤11.0.0Update to 11.1.0
- Medium5.3Unauthenticated Price Manipulation
Event Booking Manager for WooCommerce Pro
≤5.0.2Update to 5.0.3
- Medium6.4Page Builder <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Brizy – Page Builder
≤2.8.18Update to 2.8.19