Database
WordPress Vulnerability Database (page 198)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) SQL Injection
Dokan Pro
≤5.0.2No patch available
- Medium5.3Missing Authorization
Thrive Themes – Product Manager
≤10.9.2Update to 10.9.2.1
- Medium5.3Unauthenticated Information Exposure
PeproDev Ultimate Invoice
≤2.2.6No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Custom links in Elementor Image Carousel
≤1.1.1No patch available
- Medium5.3Unauthenticated Information Exposure
Ebook Store
≤6.19Update to 6.20
- High7.5Unauthenticated SQL Injection
AWP Classifieds
≤4.4.7Update to 4.4.8
- Medium4.3Cross-Site Request Forgery
Popup for CF7 with Sweet Alert
≤1.6.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Dokan Pro
≤5.0.0No patch available
- High7.5Unauthenticated SQL Injection
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.14.0Update to 8.14.1
- Medium6.5Authenticated (Contributor+) SQL Injection
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤4.0.1Update to 4.0.2
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery
≤2.7.7.29Update to 2.7.7.30
- Medium5.3Missing Authorization
Dokan Pro
≤5.0.3No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.10Update to 4.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
LIQUID SPEECH BALLOON
≤1.2.7Update to 1.2.8
- Medium5.3Missing Authorization
Civi Framework
≤2.2.0No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
Dokan Pro
≤5.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
BSK PDF Manager
≤3.8Update to 3.8.1
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
TinyMCE Templates
≤4.8.1No patch available
- Medium4.3Insecure Direct Object Reference
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.7Update to 3.0.8
- High7.2Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting
Manual - Documentation, Knowledge Base & Education WordPress Theme
≤7.5.4No patch available
- Medium5.3Unauthenticated Price Maniputlation
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.7.2Update to 2.7.3
- High7.5Unauthenticated SQL Injection
MapSVG
≤8.14.0Update to 8.14.1
- High7.5Unauthenticated SQL Injection
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.10Update to 4.7.11
- High7.5Unauthenticated SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.9.7Update to 7.9.8
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Data Disclosure
Simply Schedule Appointments
≤1.6.12.10Update to 1.6.12.11
- High7.2Unauthenticated Stored Cross-Site Scripting
PeproDev Ultimate Invoice
≤2.2.6No patch available
- Medium5.3Missing Authorization
Post My CF7 Form
≤6.2.0Update to 7.0.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
ShipTime: Discount Shipping
≤1.1.1Update to 1.1.5
- Medium5.3Missing Authorization
Qubely – Advanced Gutenberg Blocks
≤1.8.14No patch available
- Medium4.3Missing Authorization
TemplateSpare – No-Code Website Templates, Demo Importer & Site Migration for News, Magazine & Blog
≤4.3.1Update to 4.4.0