Database
WordPress Vulnerability Database (page 205)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action
Fense Block Vpn & Proxy
≤3.0.1Update to 3.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.18Update to 2.4.19
- Medium4.3Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal
Ninja Forms - Excel Export
≤3.3.6Update to 3.3.7
- Medium4.3Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter
Ninja Forms - Excel Export
≤3.3.6Update to 3.3.7
- Medium6.1Reflected Cross-Site Scripting via 'redirect-url'
WooCommerce Placetopay Gateway Belice
≤3.2.2No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
Smart Custom Fields
≤5.0.7Update to 5.0.8
- Critical9.8Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter
Bricksforge
≤3.1.8.6Update to 3.1.8.7
- Medium4.9Authenticated (Custom+) SQL Injection via Customer Import
Booking for Appointments and Events Calendar – Amelia
≤2.4.3Update to 2.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤27.7Update to 27.8
- Medium5.3Missing Authorization
Autopay dla WooCommerce
≤2.2.27Update to 2.2.28
- High7.2Unauthenticated Stored Cross-Site Scripting
ACF Frontend Admin by DynamiApps
≤3.29.8Update to 3.29.9
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion
wpForo Forum
≤3.1.1Update to 3.1.2
- Medium5.3Missing Authorization
Premium Packages – Sell Digital Products Securely
≤6.2.0Update to 7.0.0
- High7.5Unauthenticated SQL Injection
TrueBooker – Appointment Booking and Scheduler System
≤1.2.3Update to 1.2.4
- High7.2WPForms Lock <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting
Download Monitor - WPForms Lock
≤1.0.4Update to 1.0.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Sprout Clients – CRM and Lead Management
≤3.2.3Update to 3.2.4
- Medium5.3Unauthenticated Insecure Direct Object Reference
Easy Appointments
≤3.12.27Update to 3.12.28
- Medium5.3Missing Authorization
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
≤1.4.47Update to 1.4.48
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist
≤3.0.6Update to 3.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database
≤1.5.2Update to 1.5.3
- Critical9.1Unauthenticated Arbitrary File Download
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
<1.4.48Update to 1.4.48
- High7.5Unauthenticated SQL Injection
Premium Packages – Sell Digital Products Securely
≤6.2.0Update to 7.0.0
- High7.5Unauthenticated SQL Injection
Online Scheduling and Appointment Booking System – Bookly
≤27.7Update to 27.8
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter
Digits: WordPress Mobile Number Signup and Login
≤9.1.0.5Update to 9.1.0.6
- High8.8Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
Loco Translate
≤2.8.5Update to 2.8.6
- High8.8Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.12.8Update to 3.12.9
- Medium4.9Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter
WP Bulk Delete
≤1.4.2Update to 1.4.3
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter
SysBasics Customize My Account for WooCommerce – Live My Account Customizer
≤4.4.14Update to 4.5.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
wpForo Forum
≤3.1.1Update to 3.1.2
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.5.6Update to 8.5.7