Database
WordPress Vulnerability Database (page 20)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Privilege Escalation
WHIZZ
≤1.1.8No patch available
- Medium4.3Missing Authorization
AZEXO Store Locator
≤1.4No patch available
- Medium6.42.5.4 - Authenticated (Author+) Stored Cross-Site Scripting
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
2.5.0 – 2.5.4Update to 2.5.5
- Medium5.3Missing Authorization
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- Medium4.3Authenticated (Contributor+) Information Exposure
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- High7.3Unauthenticated Privilege Escalation
placester
≤1.4.3No patch available
- Critical9.8Unauthenticated Administrator Account Takeover
Wurdey
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
MCB – Stats
≤1.0.0No patch available
- Medium6.4Cross-Site Request Forgery to Stored Cross-Site Scripting
WP PageNavi Style
≤1.4No patch available
- Medium4.3Missing Authorization
CatFolders – WordPress Media Library Folders & Categories
≤2.5.6Update to 2.5.7
- Medium5.3Unauthenticated Email Spoofing
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium5.3Missing Authorization
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.2Update to 5.3.3
- Medium5.3Missing Authorization
DT LMS – elearning, WordPress LMS Plugin
≤1.2No patch available
- Medium5.3Unauthenticated Information Exposure
Car Dealer (Dealership) and Vehicle sales
≤4.73No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Gallery for Social Photo
≤1.0.0.41Update to 1.0.0.43
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Easy Social Icons
≤4.0.2Update to 4.0.3
- Low2.7Authenticated (Editor+) Information Exposure
weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce
<2.1.7Update to 2.1.7
- Low2.7Missing Authorization
weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce
<2.1.7Update to 2.1.7
- Medium5.3Unauthenticated Information Exposure
WATI Chat and Notification
≤1.1.8No patch available
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- High7.5Unauthenticated SQL Injection
IVPAY payments
≤1.0.8No patch available
- High7.31.0.16 - Unauthenticated Privilege Escalation
Security For WooCommerce
1.0.10 – 1.0.16No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Cloud Blocks
≤1.1.8No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Easy Social Icons
≤4.0.2Update to 4.0.3
- Medium5.9Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response
WP Fastest Cache – WordPress Cache Plugin
≤1.5.3Update to 1.5.4
- Critical9.8Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤260927Update to 261001
- Critical9.8Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
Ultra Addons for Contact Form 7
≤3.5.54Update to 3.5.55
- Medium6.5Authenticated (Subscriber+) SQL Injection
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<5.1.0Update to 5.1.0
- Medium5.3Missing Authorization
Essential Real Estate
≤5.3.4Update to 5.3.5