Database
WordPress Vulnerability Database (page 207)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
WP Customer Area
≤8.3.5Update to 8.3.6
- Medium5.3Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action
FoodBook Lite – Online Food Ordering System
≤1.5.6Update to 1.5.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets
News Kit Addons For Elementor
≤1.4.6Update to 1.4.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
Avada (Fusion) Builder
≤3.15.5Update to 3.15.6
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
Smart Slider 3
≤3.5.1.37Update to 3.5.1.38
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Mailgun List Subscription
Mailgun for WordPress
≤2.2.0Update to 2.2.1
- Medium5.3Unauthenticated Arbitrary Media Upload
JS Help Desk – AI-Powered Support & Ticketing System
<3.1.4Update to 3.1.4
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.8.0Update to 3.8.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Lightbox with PhotoSwipe
≤5.8.0Update to 5.9.0
- Medium5.3Insecure Direct Object Reference to Unauthenticated Order PII Disclosure
FluentCart – Online Store Builder & eCommerce Checkout
≤1.5.2Update to 1.5.3
- Critical9.8All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit
≤2.8.4Update to 2.8.5
- Medium6.5Authenticated (Contributor+) SQL Injection
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels
≤7.6.0Update to 7.6.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Auction Pro
≤2.4.5No patch available
- Medium5.3Unauthenticated Information Exposure
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.6Update to 3.0.7
- Medium5.3Insecure Direct Object Reference to Unauthenticated Person Data Modification
Events Made Easy
≤3.1.3Update to 3.1.4
- Medium5.3Unauthenticated Payment Bypass
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤6.8.1Update to 6.8.2
- Medium5.3Unauthenticated Payment Bypass
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.54Update to 2.8.55
- High7.5One Click Demo Import, Backup & Site Migration <= 0.0.6 - Unauthenticated Sensitive Data Exposure
Demi – One Click Demo Import, Backup & Site Migration
≤0.0.6Update to 0.0.7
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure
BuddyPress
≤14.4.0Update to 14.5.0
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Cross-User Support Ticket Disclosure
JS Help Desk – AI-Powered Support & Ticketing System
≤3.1.4Update to 3.1.5
- Medium5.3Unauthenticated Payment Verification Bypass
Simple Membership
≤4.7.6Update to 4.7.7
- Medium5.3Unauthenticated Information Exposure
Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce
≤1.2.7Update to 1.2.8
- Medium5.3Unauthenticated Recurring Donor Information Disclosure
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.2Update to 4.16.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Check & Log Email – Easy Email Testing & Mail logging
≤2.0.14Update to 2.0.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Addons for WPBakery
≤3.21.4Update to 3.21.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Ticket Reply Modification
JS Help Desk – AI-Powered Support & Ticketing System
≤3.1.3Update to 3.1.4
- Medium4.3Authenticated (Contributor+) User Email Disclosure
JS Help Desk – AI-Powered Support & Ticketing System
≤3.1.3Update to 3.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Auction Pro
≤2.4.5No patch available
- Medium5.3Unauthenticated Minimum Booking Bypass
Easy Booking – WooCommerce Booking & Reservation Plugin
≤3.4.0Update to 3.5.0
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Payment Data Disclosure
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.6Update to 3.0.7