Database
WordPress Vulnerability Database (page 195)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Open User Map – Interactive Leaflet Maps
≤1.4.46Update to 1.4.47
- Medium5.3Missing Authorization
Xendit Payment
≤7.2.0Update to 7.2.1
- Medium5.3Unauthenticated Arbitrary Shortcode Execution
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.14.9Update to 3.14.10
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Custom HTML Page
≤0.6.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPress Podcasting plugin by Blubrry
≤11.16.10Update to 11.16.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.1Update to 11.2.2
- Medium4.3Missing Authorization
FundEngine – Donation and Crowdfunding Platform
≤1.7.8Update to 1.7.9
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Cross-User Subscription Hijack
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.7Update to 3.0.8
- Medium4.3Cross-Site Request Forgery
GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law
≤5.0.0Update to 5.1.0
- Medium4.3Missing Authorization
Wired Impact Volunteer Management
≤2.8.1Update to 2.8.2
- High7.2Unauthenticated Server-Side Request Forgery
Simple Link Directory Pro - AI Powered
≤15.0.6Update to 15.0.7
- Medium5.3Unauthenticated Category-Locked Content Disclosure
Passster – Password Protect Pages and Content
≤4.3.5Update to 4.3.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
≤1.5.1Update to 1.5.2
- High8.8Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field
Fluent Forms Pro Add On Pack
≤6.2.6Update to 6.2.7
- High7.2Unauthenticated Server-Side Request Forgery
Simple Google Calendar Outlook Events Widget
≤3.0.0Update to 3.1.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤28.0Update to 28.1
- High8.1Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
WPForms Pro
≤1.10.1.1Update to 2.0.0
- Medium6.5Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter
Checkout Field Editor for WooCommerce (Pro)
≤3.7.7Update to 3.7.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Blog Floating Button
≤1.4.20No patch available
- High7.2Unauthenticated Server-Side Request Forgery
AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking
≤2.3.5Update to 2.3.6
- Medium5.3Missing Authorization
Events Made Easy
≤3.1.3Update to 3.1.4
- Critical9.8Unauthenticated Arbitrary File Upload
Personal QR Message
≤1.0No patch available
- Medium5.3Missing Authorization
Event Tickets and Registration
≤5.29.0.1Update to 5.29.1
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
SoftMarket — Digital Marketplace
≤1.0.0No patch available
- Medium4.3Missing Authorization
Visual Composer Website Builder
≤45.15.0Update to 45.16.0
- Medium4.3Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Product Attribute Modification
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.8Update to 5.0.9
- Medium4.4Authenticated (Shop manager+) Stored Cross-Site Scripting
Abandoned Cart Lite for WooCommerce
≤6.8.0Update to 6.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Social Login, Social Sharing by miniOrange
≤7.8.0Update to 7.8.1
- Critical9.8Backdoored Software via Compromised Vendor Software
Google Maps Easy Pro
1.6.0 – 1.6.0Update to 1.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.6.2Update to 4.7.0