Database
WordPress Vulnerability Database (page 209)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Starboard Suite Reservation Calendars
≤3.1.4Update to 3.1.5
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions
AI Copilot – Content Generator
≤1.4.12Update to 1.5.4
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear'
AI Copilot – Content Generator
≤1.4.12Update to 1.5.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification
Affilia – Affiliate Program
≤3.3.3Update to 3.3.4
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action
Solace Extra
≤1.5.3Update to 1.6.0
- High8.8Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter
Simple JWT Login – Allows you to use JWT on REST endpoints.
≤3.6.6Update to 3.6.7
- Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.84Update to 4.11.85
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'content_position_css' Parameter
Print, PDF & Email by PrintFriendly
≤5.5.10Update to 5.5.11
- High7.2Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
Planyo online reservation system
≤3.0Update to 3.1
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute
PDF Invoices & Packing Slips for WooCommerce
≤5.14.0Update to 5.15.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Action
Notification for Telegram
≤3.5.1Update to 3.5.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'val' Parameter
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.1.9Update to 1.2.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Data Disclosure and Modification via wcmp_get_shipment_options and wcmp_save_shipment_options AJAX Actions
MyParcel
≤4.25.1Update to 4.25.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
Mux Video Uploader
≤1.1.4Update to 1.1.5
- High7.5Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting
LA-Studio Element Kit for Elementor
≤1.6.1Update to 1.6.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
Motors – Car Dealership & Classified Listings Plugin
≤1.4.112Update to 1.4.113
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute
SimpLy Gallery
≤3.3.3.1Update to 3.3.3.2
- Medium5.3Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
Members – Membership & User Role Editor Plugin
≤3.2.22Update to 3.2.23
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting
Lockme calendars integration
≤2.11.0Update to 2.11.1
- Medium6.5Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder
KiviCare – Clinic & Patient Management System (EHR)
≤4.5.0Update to 4.5.1
- Medium6.5Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController
KiviCare – Clinic & Patient Management System (EHR)
≤4.5.0Update to 4.5.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions
Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification
≤2.10.1Update to 2.10.2
- High8.8Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤8.0.1Update to 8.1
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter
Under Construction
≤5.76Update to 5.81
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter
WP Grid Builder
≤2.3.3Update to 2.3.4
- Critical9.8Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow
Social Login, Social Sharing by miniOrange
≤7.7.0Update to 7.8.0
- High7.2Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()
GEO Plugin by Squirrly SEO
≤14.0.0Update to 14.0.1
- Medium5.3Missing Authorization to Unauthenticated Booking Object Mass Assignment
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.7Update to 5.6.8
- Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
≤3.4.8Update to 3.4.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Breakdance
≤2.7.1Update to 2.7.2