Database
WordPress Vulnerability Database (page 196)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Arbitrary File Upload
Improve SEO
≤2.0.11No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Lesson Content Disclosure
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.8.2Update to 3.8.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Vendor+) Arbitrary Order Status Modification
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.8Update to 5.0.9
- High8.8Code Injection to Authenticated (Admin+) PHP Code Injection
Create Block Theme
≤2.9.0Update to 2.10.0
- Medium6.6Authenticated (Administrator+) PHP Object Injection
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
≤2.4.2Update to 2.4.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Private Post Disclosure
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.50.0Update to 3.51.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Dynamic Pricing With Discount Rules for WooCommerce
≤4.5.11Update to 5.0.0
- Medium4.9Authenticated (Editor+) SQL Injection
sm page duplicator
≤1.0.0No patch available
- Medium4.9Authenticated (Admin+) Arbitrary File Read
Import and export users and customers
<2.4.3Update to 2.4.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
≤3.0.7Update to 3.0.8
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
SVG Support
≤2.5.16Update to 2.5.17
- Medium4.3Missing Authorization
ProfileGrid – User Profiles, Groups and Communities
≤5.0.0.0Update to 6.0.0.0
- Medium5.3Missing Authorization
Simple Membership
≤4.7.7Update to 4.7.8
- High7.5Unauthenticated SQL Injection
Super Store Finder
≤7.10Update to 7.11
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels
≤7.6.1Update to 7.6.2
- Medium5.3Unauthenticated Information Exposure
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.97.6Update to 2.97.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Membership
≤4.7.7Update to 4.7.8
- Medium5.3Missing Authorization
ChamaWP – Monetize With Donations, Memberships, Crowdfunding, Commissions & Restricted Content
≤1.0.12Update to 1.0.13
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Geolocation Record Modification and Deletion
GEO my WP
≤4.5.5.2Update to 4.5.5.3
- High7.2Authenticated (Editor+) Arbitrary File Upload
Insert or Embed Articulate Content into WordPress
≤4.3000000027No patch available
- High7.5Unauthenticated SQL Injection
LogMyTrip
≤1.9No patch available
- High7.3Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action
EventON Action User
≤2.5.14Update to 2.5.15
- Medium4.9Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.14.9Update to 3.14.10
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter
VikBooking Hotel Booking Engine & PMS
≤1.8.13Update to 1.8.14
- Medium6.1Reflected Cross-Site Scripting via 'category_id' Parameter
VikBooking Hotel Booking Engine & PMS
≤1.8.13Update to 1.8.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
SureDash – Community, Courses & Member Dashboard
≤1.10.0Update to 1.10.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute
Rich Showcase for Google Reviews
≤6.9.9Update to 6.9.10
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret
Payment Plugins for Stripe WooCommerce
≤4.0.7Update to 4.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Open User Map – Interactive Leaflet Maps
≤1.4.45Update to 1.4.46
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute
Fluent Support – Helpdesk & Customer Support Ticket System
≤2.3.0Update to 2.3.1