Database
WordPress Vulnerability Database (page 197)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.11Update to 2.2.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.11Update to 2.2.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
Brands for WooCommerce
≤3.8.8Update to 3.8.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤4.0.5Update to 4.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
WP Hotel Booking
≤2.3.2Update to 2.3.3
- High8.1Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion
Easy Appointments
≤3.12.27Update to 3.12.28
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
Post Grid Gutenberg Blocks – PostX
≤5.0.32Update to 5.0.33
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
Participants Database
≤2.7.8.3Update to 2.7.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.14.0Update to 8.14.1
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.14Update to 6.1.0
- Medium6.4Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
Firelight Lightbox
≤2.3.20Update to 2.3.21
- High8.0Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce
≤5.4.16Update to 5.4.17
- Medium4.3Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
≤5.0.0Update to 5.0.1
- Critical9.8Unauthenticated Authentication Bypass via SAMLResponse Parameter
SAML Single Sign On – SSO Login
≤5.4.4Update to 5.4.5
- High8.8Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤43.2Update to 43.3
- Medium5.3Unauthenticated Information Exposure
WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets
≤4.3.0Update to 4.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Accept Donations with PayPal & Stripe
≤1.5.5Update to 1.5.6
- High7.5Unauthenticated SQL Injection
Link Library
≤7.9.2Update to 7.9.3
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.4.3Update to 5.4.4
- Medium4.3Cross-Site Request Forgery
Kwayy HTML Sitemap
≤5.0Update to 5.1
- Medium4.3Missing Authorization
Cyr to Lat Reloaded – Transliteration of Links and File Names
≤1.3.3Update to 1.3.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Smart SEO Tool – SEO优化插件
≤4.1.2No patch available
- Medium4.3Cross-Site Request Forgery
افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری
≤4.4.5No patch available
- Medium5.3Missing Authorization
CoCart – Headless REST API for WooCommerce
≤4.8.4Update to 4.9.0
- Medium5.3Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Missing Authorization
Manual - Documentation, Knowledge Base & Education WordPress Theme
≤7.5.4No patch available
- Medium4.3Missing Authorization
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤30.0.6Update to 30.0.7
- Medium4.3Missing Authorization
Avada Custom Branding
≤1.2No patch available
- Medium5.3Missing Authorization
PeproDev Ultimate Invoice
≤2.2.6No patch available
- Medium4.9Authenticated (Shop manager+) SQL Injection
افزونه پیامک ووکامرس | Persian WooCommerce SMS
≤7.2.2No patch available
- Medium5.3Missing Authorization
Payment Plugins for Stripe WooCommerce
≤4.0.7Update to 4.0.8