Database
WordPress Vulnerability Database (page 201)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Ebook Store
≤6.19Update to 6.20
- Medium6.4Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Manual - Documentation, Knowledge Base & Education WordPress Theme
≤7.5.4No patch available
- Medium5.3Missing Authorization
LA-Studio Element Kit for Elementor
≤1.6.2Update to 1.6.3
- Critical9.8Authenticated (Subscriber+) Privilege Escalation
WP BASE Booking of Appointments, Services and Events
≤6.3.1Update to 6.3.2
- Medium6.5Authenticated (Contributor+) SQL Injection
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.0Update to 11.2.1
- Medium4.3Missing Authorization
Style Kits for Elementor
≤2.6.5Update to 2.6.6
- Medium5.3Missing Authorization
AWP Classifieds
≤4.4.7Update to 4.4.8
- Medium6.5Authenticated (Contributor+) SQL Injection
Create
≤2.5.3Update to 2.5.4
- Medium4.3Missing Authorization
reviewer
≤3.14.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
≤1.16.3Update to 1.17.0
- Critical9.1Unauthenticated Arbitrary File Deletion
Participants Database
≤2.7.8.3Update to 2.7.8.4
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Product Slider, Product Grid, Product Masonry
≤1.13.62Update to 1.13.63
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.3.6Update to 5.3.7
- Medium5.3Missing Authorization
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership
≤3.3.5Update to 3.3.6
- Medium5.3Missing Authorization
Event Post
≤6.1.0Update to 6.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Hubbub Lite – Fast, free social sharing and follow buttons
≤1.36.3Update to 1.36.3.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP-Polls
≤2.77.3Update to 3.0.0
- Medium6.5Authenticated (Contributor+) SQL Injection
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.14.0Update to 8.14.1
- Medium5.3Missing Authorization
miniOrange Discord Integration
≤2.2.4Update to 2.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.1.1Update to 2.9.1.2
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
Polylang
≤3.8.5Update to 3.8.6
- Medium4.3Missing Authorization
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.3.1Update to 2.3.2
- High7.2Authenticated (Admin+) Arbitrary File Upload
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.14.0Update to 8.14.1
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.18Update to 2.4.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.14.0Update to 8.14.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
TheGem
≤5.11.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder
≤3.0.5Update to 3.0.7
- Medium6.5Authenticated (Contributor+) SQL Injection
MapSVG
≤8.14.0Update to 8.14.1
- Medium5.3Unauthenticated Sensitive Information Exposure
Create
≤2.6.0Update to 2.6.1