Database
WordPress Vulnerability Database (page 194)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.1Unauthenticated Arbitrary File Deletion
Custom Fields for WooCommerce
≤1.5.0Update to 1.5.1
- Medium4.3Missing Authorization
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤6.2.6Update to 6.2.7
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
≤3.0.7Update to 3.0.8
- Medium4.3Authenticated (Subscriber+) Information Exposure
ЮKassa для WooCommerce
≤2.16.1Update to 2.16.2
- Medium5.3Missing Authorization
Easy Integration for Dropbox – File Manager
≤2.1.0Update to 2.2.0
- Medium5.3Unauthenticated Non-Public Post Content Disclosure
Passster – Password Protect Pages and Content
≤4.3.5Update to 4.3.6
- Medium5.3Missing Authorization to Unauthenticated Account Creation While Registration Disabled
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.5Update to 5.2.6
- Medium4.4Authenticated (Shop manager+) Stored Cross-Site Scripting
Checkout Field Editor for WooCommerce – Checkout Manager
≤3.0.5Update to 3.0.6
- Medium4.3Page Builder <= 2.8.18 - Insecure Direct Object Reference to Authenticated (Contributor+) Template Type Update
Brizy – Page Builder
≤2.8.18Update to 2.8.19
- High7.2Unauthenticated Stored Cross-Site Scripting
Booking Calendar
≤11.4.2Update to 11.4.3
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤4.0.5Update to 4.0.6
- Medium4.3Insecure Direct Object Reference to Authenticated (Store Owner+) Cross-Store Commission Data Disclosure
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.10Update to 5.0.11
- High7.2Unauthenticated Server-Side Request Forgery
FormCraft
≤3.9.15Update to 3.9.16
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.3Update to 4.16.4
- Medium4.3Cross-Site Request Forgery
WP Google Review Slider
≤18.4Update to 18.5
- Medium6.5Authenticated (Authenticated+) SQL Injection
Database for Contact Form 7, WPforms, Elementor forms
≤1.5.4Update to 1.5.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultra Addons for Contact Form 7
≤3.5.45Update to 3.5.46
- Medium4.3Missing Authorization
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
≤1.5.1Update to 1.5.2
- Medium5.3Missing Authorization to Unauthenticated Sensitive Log Data Disclosure
REST API Log
≤1.7.0Update to 1.7.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Nested Pages
≤3.2.14Update to 3.2.15
- Medium6.5Authenticated (Admin) Arbitrary File Deletion
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.6.9Update to 3.6.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.3Update to 1.3.4
- Medium5.3Missing Authorization
The GDPR Framework By Data443
≤2.3.0Update to 2.4.0
- High7.2Unauthenticated Blind Server-Side Request Forgery
EmbedPress
≤4.6.0Update to 4.6.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Anti Spam and list cleaner – AcyChecker
≤1.8.1Update to 2.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting
GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO
≤4.4.3Update to 4.5.0
- Medium5.3Insecure Direct Object Reference to Unauthenticated Shipping Label Download
DHL Shipping Germany for WooCommerce
≤4.0.0Update to 4.0.1
- Medium4.3Information Exposure to Authenticated (Contributor+) User Email Disclosure
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.167Update to 2.8.168
- Medium4.9Authenticated (Administrator+) SQL Injection via 'id' Parameter
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.7Update to 3.9.8
- Medium5.3Unauthenticated Shipping Label Disclosure
DHL Shipping Germany for WooCommerce
≤4.0.0Update to 4.0.1