Database
WordPress Vulnerability Database (page 204)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Privilege Escalation
Authora : Easy login with mobile number
<1.7.7Update to 1.7.7
- Medium4.3Authenticated (Contributor+) Information Exposure
Simple Restrict
<1.2.9Update to 1.2.9
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Unauthorized Order Refund
Buckaroo Payments for WooCommerce
≤4.8.0Update to 4.9.0
- Medium5.3Missing Authorization to Unauthenticated OAuth Update
Builderall for WordPress
≤3.0.1Update to 3.0.2
- Medium4.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.6.10.1Update to 3.6.11
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Slider Pro
≤4.8.13Update to 4.8.14
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
wpForo Forum
≤3.1.1Update to 3.1.2
- Medium5.3Unauthenticated Price Manipulation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.4Update to 6.0.9.5
- Medium4.3Authenticated (Contributor+) CSS Injection
Spectra Legacy – Gutenberg Blocks
<2.20.0Update to 2.20.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)
≤8.90.0Update to 8.91.0
- Medium6.1Reflected XSS via Posts Grid Widget
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.75Update to 51.1.76
- Medium4.3Cross-Site Request Forgery to Settings Update
W3SC Elementor to Zoho CRM
≤2.2.0No patch available
- Medium5.3Unauthenticated Two-Factor Authentication Bypass to Password Reset
Chat On Desk Order Notifications – WooCommerce
≤1.0.8Update to 1.0.9
- High7.2Authenticated (Admin+) Arbitrary File Upload
Theme Demo Import
≤1.1.3No patch available
- High7.2Authenticated (Admin+) Arbitrary File Upload
Everest Toolkit
≤1.2.3No patch available
- High7.3Privilege Escalation to Unauthenticated Account Takeover
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.16.3Update to 3.16.4
- Critical9.8Unauthenticated Privilege Escalation
TrueBooker – Appointment Booking and Scheduler System
≤1.2.3Update to 1.2.4
- Medium4.3Authenticated (Subscriber+) Payment Bypass
RealHomes Memberships
≤3.0.0Update to 3.1.0
- Medium6.6Products Filter Professional for WooCommerce <= 1.4.0 - Authenticated (Shop manager+) Local File Inclusion
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
≤1.4.0Update to 1.4.1
- High7.5KEVPoC7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter
WordPress
<7.0.2Update to 6.8.6 or 6.9.5 or 7.0.2
- Critical9.8KEVPoC7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
WordPress
<7.0.2Update to 6.9.5 or 7.0.2
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script
HubSpot All-In-One Marketing – Forms, Popups, Live Chat
≤11.3.62Update to 11.3.64
- Medium6.1Reflected Cross-Site Scripting via 'check_in_date' Parameter
WP Hotel Booking
≤2.3.2Update to 2.3.3
- Medium6.5Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read
pCloud WP Backup
≤2.0.3Update to 2.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes
ChatHelp – Click to Chat Button, Chat to Order for WooCommerce & Floating Chat Form
≤3.5.1Update to 3.5.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.1Update to 4.4.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.6Update to 1.17.7
- High8.8Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.16.18Update to 4.16.19
- Medium6.4Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter
Ninja Forms - Excel Export
≤3.3.6Update to 3.3.7
- Medium4.9Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.13Update to 6.0.14