Database
WordPress Vulnerability Database (page 199)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Appointment Hour Booking – Booking Calendar
≤1.5.86Update to 1.5.87
- Medium4.3Two-Factor Authentication Bypass
Hide My WP Ghost – Security & Firewall
≤7.0.06Update to 7.0.07
- Medium5.3Unauthenticated Google OAuth Token Disclosure
Gallery for Google Photos – share your albums right on your site
≤1.2.0Update to 1.2.1
- High7.2Authenticated (Admin+) Privilege Escalation
Import and export users and customers
≤2.4.1Update to 2.4.2
- Medium4.9Authenticated (Administrator+) SQL Injection
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
≤2.10.22Update to 2.10.23
- Medium5.3Missing Authorization
Graphina – Charts and Graphs For Elementor
≤3.1.12Update to 3.1.13
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.4.3Update to 5.4.4
- Medium4.3Cross-Site Request Forgery
WP Activity Log
≤5.6.4Update to 5.6.5
- High7.5Unauthenticated SQL Injection
Relevanssi Light
≤1.2.2Update to 1.2.3
- High7.2Unauthenticated Server-Side Request Forgery
Flipbook PDF Viewer & Embedder
≤1.4.2Update to 1.4.4
- High7.2Unauthenticated Server-Side Request Forgery
PeproDev Ultimate Invoice
≤2.2.6No patch available
- Medium5.3IP Allowlist Bypass
Security Optimizer – The All-In-One Protection Plugin
≤1.6.4Update to 1.6.5
- Medium5.3Unauthenticated Information Exposure
Byteflows Travel & Hotel Booking
≤1.0.0Update to 1.0.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Machete
≤5.2Update to 5.3
- Medium5.3Missing Authorization
Falcon – Cache, Performance, Security, Cleanup, and Tweaks
≤2.10.0Update to 2.10.1
- Medium6.3Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter
Premium Packages – Sell Digital Products Securely
≤7.0.4Update to 7.0.5
- Medium6.5Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
Tickera – Sell Tickets & Manage Events
≤3.6.0.1Update to 3.6.0.2
- Medium6.5Authenticated (Contributor+) SQL Injection via 'standard' Parameter
Registrations for the Events Calendar – Event Registration Plugin
≤3.2Update to 3.2.1
- Critical9.8Unauthenticated Privilege Escalation via OAuth Authorization Endpoint
MountDev AI MCP Connector for WordPress
≤1.6.1Update to 1.6.2
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers
MDJM Event Management
≤1.7.8.4Update to 1.7.8.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta
Header Footer Script Adder
≤2.1Update to 2.1.1
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter
AI Copilot – Content Generator
≤1.5.4Update to 1.5.8
- Medium4.4Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter
WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect
≤7.8.6.6Update to 7.8.6.7
- Medium6.5Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter
WCPOS – Point of Sale (POS) plugin for WooCommerce
≤1.9.8Update to 1.9.9
- Medium6.5Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter
Tickera – Sell Tickets & Manage Events
≤3.6.0.1Update to 3.6.0.2
- Medium6.5Authenticated (Admin+) SQL Injection via 'orderby' Parameter
Premium Packages – Sell Digital Products Securely
≤7.0.4Update to 7.0.5
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
≤2.4.12Update to 2.4.13
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute
Grid/List View for WooCommerce
≤3.0.9Update to 3.0.9.1
- Critical9.8Unauthenticated Arbitrary File Upload via WPForms File Upload Field
GoDAM – Video Hosting for LMS & Online Courses
≤1.12.2Update to 2.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
≤1.46.0Update to 1.47.0