Database
WordPress Vulnerability Database (page 212)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
≤3.1.7Update to 3.1.8
- High8.1Unauthenticated PHP Object Injection
777
≤1.13.0No patch available
- Medium5.3Multisite Premium <= 38.5.8 - Missing Authorization
WordPress Single Sign-On (SSO) - Multisite Enterprise
≤38.5.8Update to 38.5.8.1
- High7.5Unauthenticated SQL Injection
BuddyBoss Platform
≤3.0.5Update to 3.1.0
- High7.1Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
≤3.1.1Update to 3.1.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action
Employee, Leave and Recruitment Management System – Crew HRM
≤1.2.2Update to 1.2.3
- Medium5.3Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions
Easy Invoice – Invoice Generator, PDF Quotes & Payments
≤2.2.19Update to 2.2.20
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Reset
DSGVO All in one for WP
≤4.9Update to 5.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions
DHL eCommerce (Benelux) for WooCommerce
≤2.2.3Update to 2.2.4
- High8.8Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint
Divi Torque Lite
≤4.2.3Update to 4.3.0
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter
CorvusPay WooCommerce Payment Gateway
≤2.7.4Update to 2.7.5
- Medium5.3Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint
CorvusPay WooCommerce Payment Gateway
≤2.7.4Update to 2.7.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action
Colissimo shipping methods for WooCommerce
≤2.9.0Update to 2.10.0
- Medium6.5Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter
Blocks for ACF Fields — Display Custom Fields in the Block Editor
≤1.6.2Update to 1.6.3
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.1Update to 1.2.2
- Medium5.3Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.7Update to 4.3.8
- Medium4.9Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.24.2Update to 1.24.3
- High7.2Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.22.0Update to 1.23.0
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.9.4Update to 7.9.5
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.7Update to 4.3.8
- Critical9.8Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.1Update to 5.5.2
- Medium6.1Reflected Cross-Site Scripting via 'stag' Parameter
Mang Board
≤2.3.4Update to 2.3.5
- Medium6.5Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.5Update to 1.17.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute
Post Grid Gutenberg Blocks – PostX
≤5.0.31Update to 5.0.32
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
Download Manager
≤3.3.61Update to 3.3.62
- High7.2Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values
Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend
≤0.9.78.06Update to 0.9.78.07
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤10.10.2Update to 10.11.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Bookero.pl – system rezerwacji online
≤2.2Update to 2.3
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function
Backup and Staging by WP Time Capsule
≤1.22.26Update to 1.22.27
- Medium5.3Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parameter
Age Verification & Identity Verification by Token of Trust
≤4.0.2Update to 4.0.3