Database
WordPress Vulnerability Database (page 200)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Code Injection via 'path' Parameter
Customer Support Ticket System & Helpdesk
≤6.0.5Update to 6.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Bulk Page Generator – LPagery
≤2.5.7Update to 2.5.8
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field
Brands for WooCommerce
≤3.8.8Update to 3.8.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Brands for WooCommerce
≤3.8.8Update to 3.8.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter
Web Push Notifications – Webpushr
≤4.39.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
WP Shortcode by MyThemeShop
≤1.4.17No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'password' Field Values
ARforms
≤7.2.1Update to 7.2.2
- High7.5Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload
Product Designer for WooCommerce WordPress | Lumise
≤2.1.1Update to 2.1.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter
SUMO Reward Points for WooCommerce
≤32.7.0Update to 32.8.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters
FormCraft
≤3.9.14Update to 3.9.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Modula Image Gallery – Photo Grid & Video Gallery
2.14.25 – 2.14.30Update to 2.14.31
- Medium4.3Authenticated (Subscriber+) Remote Code Execution
Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode
≤3.8.11Update to 3.9.0
- Medium5.3Missing Authorization
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.12Update to 5.13
- Medium6.5Authenticated (Contributor+) SQL Injection
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2
- Medium4.3Missing Authorization
Directory Listings WordPress plugin – uListing
≤2.2.0No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Shiptastic for WooCommerce
≤5.1.0Update to 5.1.1
- Medium6.4Authenticated (Author+) Server-Side Request Forgery
Complianz GDPR/CCPA Cookie Consent Banner
≤7.5.1Update to 7.5.2
- High7.5Authenticated (Contributor+) Local File Inclusion
Tonda Core
≤2.1.2No patch available
- Critical9.8Unauthenticated Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.6Update to 3.9.7
- Medium4.9Authenticated (Administrator+) SQL Injection
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.3.2Update to 7.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
LA-Studio Element Kit for Elementor
≤1.6.2No patch available
- High7.5Unauthenticated SQL Injection
Participants Database
≤2.7.8.3Update to 2.7.8.4
- High7.5Authenticated (Contributor+) Local File Inclusion
Vino - A Refined Winery, Wine Bar and Vineyard WordPress Theme
≤1.9No patch available
- Medium5.3Missing Authorization
Payment Gateway for PayPal on WooCommerce
≤9.1.4Update to 9.1.5
- Medium4.4Authenticated (Shop manager+) Stored Cross-Site Scripting
Tabs Responsive – With WooCommerce Product Tabs Extension
≤2.5No patch available
- Medium5.3Missing Authorization
JetBooking
≤4.1.2Update to 4.1.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Virtue/Ascend/Pinnacle Toolkit
≤4.9.12Update to 4.9.12.1
- Medium4.3Missing Authorization
Mediavine Control Panel
≤2.10.10Update to 2.10.11
- Medium6.4Authenticated (Author+) Sever-Side Request Forgery
Photo Block – A Modern Image Block With Lightbox and Caption Support
≤1.7.1No patch available
- Medium4.3Missing Authorization
Query Wrangler
≤1.5.57Update to 1.5.58