Database
WordPress Vulnerability Database (page 203)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
LA-Studio Element Kit for Elementor
≤1.6.2Update to 1.6.3
- Medium4.3Missing Authorization
Directory Listings WordPress plugin – uListing
≤2.2.0No patch available
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
DTX – Dynamic Text Extension for Contact Form 7
≤5.0.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder
≤2.9.1Update to 2.9.2
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action
WP Foodbakery
≤4.9No patch available
- Medium6.1Reflected Cross-Site Scripting
Grand Photography WordPress
≤5.7.8No patch available
- Medium5.3Missing Authorization
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
≤9.6.0.0Update to 9.6.0.1
- Medium4.3Authenticated (Subscriber+) Arbitrary Content Deletion
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.0Update to 4.5.1
- Medium4.3Authenticated (Customer+) Arbitrary Content Deletion
License Manager for WooCommerce
≤3.0.17Update to 3.0.18
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.3.0Update to 2.3.1
- Medium4.3Cross-Site Request Forgery
MailPoet – Newsletters, Email Marketing, and Automation
5.30.0 – 5.33.0Update to 5.33.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
≤4.0.12Update to 4.0.13
- Medium5.3Unauthenticated Price Manipulation
WP Hotel Booking
≤2.3.2Update to 2.3.3
- Critical9.1Unauthenticated Arbitrary File Deletion
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.2.4Update to 7.2.5
- Medium6.1Reflected Cross-Site Scripting
AffiliateWP
≤2.34.0Update to 2.34.1
- High7.2Unauthenticated Stored Cross-Site Scripting
PiWeb Product Enquiry or product catalog for WooCommerce
≤2.2.34.43Update to 2.2.34.44
- Medium5.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.40Update to 2.1.50
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.6.11Update to 6.7.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
Tutor LMS Elementor Addons
≤4.0.0No patch available
- High7.2Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.14.0Update to 8.14.1
- Critical9.8Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
≤4.0.11Update to 4.0.12
- Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤2.0.0.1Update to 2.0.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.6.11Update to 6.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block
Spectra Legacy – Gutenberg Blocks
≤2.19.28Update to 2.19.29
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Picture Gallery – Frontend Uploads & Image Editor
≤1.6.5Update to 1.6.6
- Medium5.3Unauthenticated Insecure Direct Object Reference to Payment Bypass
Five Star Restaurant Reservations – WordPress Booking Plugin
≤2.7.22Update to 2.7.23
- Medium5.3Unauthenticated Price Manipulation
CoCart – Headless REST API for WooCommerce
≤4.8.0Update to 4.9.0
- Medium6.1Reflected Cross-Site Scripting
Real Estate Manager Pro
≤12.8.5Update to 12.8.6
- Medium5.3Unauthenticated Conversion Forge
Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels
<2.2.1Update to 2.2.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
≤1.5.1Update to 1.5.2