Database
WordPress Vulnerability Database (page 210)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Custom Icon Font Deletion
Ultimate Addons for WPBakery
<3.21.4Update to 3.21.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Database for Contact Form 7, WPforms, Elementor forms
≤1.5.2Update to 1.5.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Document Gallery
≤5.1.0Update to 5.1.1
- Medium6.5Unauthenticated Group Registration Bypass
ProfileGrid – User Profiles, Groups and Communities
<5.9.9.8Update to 5.9.9.8
- High7.2Unauthenticated Stored Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.2.2Update to 9.2.3
- High8.8Authenticated (Customer+) Privilege Escalation
Customer Switching for WooCommerce
<2.1.3Update to 2.1.3
- High7.5Unauthenticated SQL Injection via 'email' Form Parameter
Booking Package
≤1.7.20Update to 1.7.21
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Update
WS Form LITE – Drag & Drop Contact Form Builder
≤1.11.7Update to 1.11.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.6Update to 5.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.15.0.8Update to 3.15.0.9
- High7.2Unauthenticated Stored Cross-Site Scripting
ICS Calendar
≤12.1.1Update to 12.1.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Google Maps Pro
≤10.1.02Update to 10.1.03
- High7.2Unauthenticated Stored Cross-Site Scripting
WPZOOM Portfolio Lite – Filterable Portfolio Plugin
≤1.4.29Update to 1.4.30
- Medium4.9Authenticated (Administrator+) SQL Injection via 'recipients' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.24.1Update to 1.24.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter
Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase
≤5.5Update to 5.5.4
- Medium5.3Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint
KiviCare – Clinic & Patient Management System (EHR)
≤4.4.0Update to 4.5.0
- Medium6.5Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.7.9Update to 5.7.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
≤3.2.6Update to 3.2.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions
Invoice123
≤1.7.0Update to 1.7.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action
Import and export users and customers
≤2.4.0Update to 2.4.1
- Medium6.1Reflected Cross-Site Scripting via 'htmltagtitle' Parameter
ICS Calendar
≤12.0.9Update to 12.0.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode
Hostel
≤1.1.7Update to 1.1.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' Setting
Highlighting Code Block
≤2.2.0Update to 2.2.1
- Medium6.6Authenticated (Admin+) Local File Inclusion
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
≤1.26.12Update to 1.26.13
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
GW AI Website Builder
≤1.0.1Update to 1.0.2
- Medium4.3Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'
GoodMeet – Meetings & Classes for Google Meet
≤1.1.8Update to 1.1.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.15Update to 4.1.16
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints
FlowForms – Conversational Form Builder
≤1.1.1Update to 1.1.2
- Medium5.34.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
4.0.26 – 4.1.15Update to 4.1.16
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter
Easy Upload Files During Checkout
≤3.0.1Update to 3.0.2