Database
WordPress Vulnerability Database (page 208)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Bulk Edit Products for WooCommerce – WP Sheet Editor
≤1.8.21Update to 1.8.22
- Medium4.3Cross-Site Request Forgery
ووسلام – همگام سازی ووکامرس و باسلام
≤1.9.1Update to 1.9.2
- Medium4.9Authenticated (Administrator+) SQL Injection
گرویتی فرم فارسی | Persian Gravity Forms
≤3.0.2Update to 3.0.3
- High8.8Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt
Genolve – AI Business Graphics, Images & Video
≤5.0.5Update to 5.0.6
- High7.5Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
W3 Total Cache
≤2.9.4Update to 2.10.0
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.2.2Update to 9.2.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields
bbp style pack
≤6.4.5Update to 6.4.6
- Medium5.3Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
Cost Calculator Builder
≤4.0.11Update to 4.0.12
- Medium4.3Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action
Wallet for WooCommerce
≤1.6.4Update to 1.6.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributes
fresh Podcaster
≤1.0.7No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection via uid Parameter
Catalyst Connect Zoho CRM Client Portal
≤2.2.0No patch available
- Medium5.3Unauthenticated Sensitive Information Exposure via 'postID' Parameter
Context Blog
≤1.3.5Update to 1.3.6
- High7.5Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter
WP CTA – Call Now Button, Sticky Button & Call to Action Builder
≤2.2.2Update to 2.3.0
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
WCFM – Frontend Manager for WooCommerce
≤6.7.27Update to 6.7.28
- Medium5.3Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler
WP Hotel Booking
≤2.3.1Update to 2.3.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.0Update to 4.5.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters
Widgets for Google Reviews
≤13.3Update to 13.3.1
- High8.8Authenticated (Contributor+) Account Takeover via Email Header Injection
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.6.10Update to 6.6.11
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings
White Label CMS
≤2.7.12Update to 2.7.13
- High7.2Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter
CorvusPay WooCommerce Payment Gateway
≤2.7.4Update to 2.7.5
- High8.8Authenticated (Contributor+) Remote Code Execution
Code Engine – PHP Snippets, AI Functions & Automation for WordPress
≤0.3.5Update to 0.3.6
- Medium4.3Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers
WCFM – Frontend Manager for WooCommerce
≤6.7.27Update to 6.7.28
- Medium6.4Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.7.3Update to 3.7.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field
Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database
≤1.5.2Update to 1.5.3
- High8.1Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.2.3Update to 4.3.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Cache Deletion
ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Customer Support Ticket System
≤2.1.7Update to 2.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field
Themify Builder
≤7.7.6Update to 7.7.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field
Themify Builder
≤7.7.6Update to 7.7.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Action
SurfLink – Link Manager & Backup Restore
<2.6.0Update to 2.6.0
- High8.8Authenticated (Author+) Arbitrary File Upload via upload_extension_files()
Swiss Toolkit For WP
≤1.4.6No patch available