Database
WordPress Vulnerability Database (page 206)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.5.6Update to 8.5.7
- Medium6.5Authenticated (Staff+) SQL Injection via 's' Parameter
Tickera – Sell Tickets & Manage Events
≤3.6.0.0Update to 3.6.0.1
- High8.1Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.3.1.4Update to 7.4.0
- Medium4.9Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter
WP TripAdvisor Review Slider
≤14.6Update to 14.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
≤1.10.2Update to 1.10.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
Tutor LMS – eLearning and online course solution
≤4.0.0Update to 4.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute
Tickera – Sell Tickets & Manage Events
≤3.6.0.0Update to 3.6.0.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter
The Cache Purger
≤2.3.20Update to 2.3.21
- Medium6.5Authenticated (Custom+) SQL Injection via 'pages' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.0Update to 11.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Webhook Action Details
Breakdance
≤2.7.1Update to 2.7.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter
SEO Booster
≤7.3.1Update to 7.3.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
SEO Booster
≤7.3.1Update to 7.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
RPB Chessboard
≤8.1.2Update to 8.1.3
- Medium6.1Reflected Cross-Site Scripting via 's' Search Parameter
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels
≤7.6.1Update to 7.6.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
MxChat – AI Chatbot & Content Generation for WordPress
≤3.2.10Update to 3.2.11
- Medium6.5Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.9Update to 5.0.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute
Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ
≤3.1.6Update to 3.1.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter
Catch Themes Demo Import
≤3.3Update to 3.4
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute
List category posts
≤0.95.0Update to 0.96.0
- Medium4.3Cross-Site Request Forgery to ulpb_admin_data AJAX Action
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages
≤1.5.3.6Update to 1.5.3.7
- Medium6.4Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.3Update to 4.16.4
- High7.5Unauthenticated SQL Injection via 's' and 'match' Parameter
Advance Product Search- Voice & Ajax Search for WooCommerce
≤1.4.4Update to 1.4.5
- High7.5Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
Gravity Forms
≤2.10.4Update to 2.10.5
- Medium4.3Missing Authorization
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.5Update to 1.17.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action
Themify Builder
≤7.7.7Update to 7.7.8
- Critical9.8Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
SAML Single Sign On – SSO Login
≤5.4.3Update to 5.4.4
- Medium5.3Two-Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
<6.2.6Update to 6.2.6
- Critical9.8Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
Podlove Podcast Publisher
≤4.5.1Update to 4.5.2
- Medium6.4Authenticated (Subsite administrator+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤3.10.0Update to 3.10.01
- High7.5Unauthenticated SQL Injection
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.12Update to 6.0.13