Database
WordPress Vulnerability Database (page 211)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation
Easy Appointments
≤3.12.27Update to 3.12.28
- Medium4.9Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.3.6Update to 4.3.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.3.6Update to 4.3.7
- Medium6.5Authenticated (Custom+) SQL Injection via 'lang' Parameter
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.6.0Update to 4.6.1
- High7.5Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter
Hide My WP Lite
≤1.3No patch available
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.8.5Update to 4.9.0
- High8.8Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.30.32Update to 10.30.33
- High7.2Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import
Post Export Import with Media
≤1.13.1Update to 1.13.2
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.14Update to 3.0.15
- Medium6.1Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters
WP Hotel Booking
≤2.3.1Update to 2.3.2
- Medium5.4Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.1Update to 6.2.2
- Critical9.8Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
Super Forms – Drag & Drop Form Builder
≤6.3.313Update to 6.3.314
- High8.1Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback
LoginPress Pro
≤6.2.3Update to 6.2.4
- High8.1Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback
LoginPress Pro
≤6.2.3Update to 6.2.4
- High8.1Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback
LoginPress Pro
≤6.2.3Update to 6.2.4
- High8.8Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.65Update to 1.2.66
- High8.1Unauthenticated PHP Object Injection
Grand Photography WordPress
≤5.7.8No patch available
- Medium5.3Unauthenticated Payment Bypass
WP Hotel Booking
≤2.3.1Update to 2.3.2
- Critical9.1Unauthenticated Arbitrary File Deletion
Membership For WooCommerce
≤3.1.0Update to 3.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.12Update to 2.0.13
- Critical9.8All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.3 - Unauthenticated Arbitrary File Upload
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit
≤2.8.3Update to 2.8.3.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Anti-Malware Security and Brute-Force Firewall
≤4.23.89Update to 4.23.90
- Medium5.3Missing Authorization
Simply Schedule Appointments
≤1.6.12.4Update to 1.6.12.6
- Critical9.8Unauthenticated Privilege Escalation
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
≤1.2.77.3Update to 1.2.78.0
- Critical9.8Unauthenticated Remote Code Execution
Realtyna Organic IDX plugin + WPL Real Estate
≤5.2.0Update to 5.3.0
- Medium5.3Missing Authorization
Simply Schedule Appointments
≤1.6.11.11Update to 1.6.12.0
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
AI ChatBot for WooCommerce with ChatGPT, Retargeting, Exit Intent
≤14.1.7Update to 14.1.8
- High7.5Authenticated (Subscriber+) PHP Object Injection
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.8.2Update to 8.8.3
- High7.5Unauthenticated SQL Injection
AI Copilot – Content Generator
≤1.5.4Update to 1.5.5
- Medium6.5Authenticated (Subscriber+) SQL Injection
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.4Update to 4.7.5