Database
WordPress Vulnerability Database (page 213)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.7Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
≤6.11.1Update to 6.11.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter
Block, Suspend, Report for BuddyPress
≤3.6.4Update to 3.6.5
- High8.1Authenticated (SureDash User+) Arbitrary File Deletion
SureDash – Community, Courses & Member Dashboard
≤1.8.0Update to 1.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Real Estate Manager Pro
≤12.8.3Update to 12.8.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
≤4.7.0Update to 4.7.1
- High8.1Authenticated (Sales Representative+) Arbitrary File Deletion
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.4.1Update to 4.5
- Medium5.3Missing Authorization
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤2.22.5Update to 2.22.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Free Gifts for WooCommerce
≤13.1.0Update to 13.3.0
- Critical9.8Unauthenticated Privilege Escalation
Houzez Login Register
≤3.3.3No patch available
- High7.5Unauthenticated Arbitrary File Read
Media folder Addon
≤4.1.6No patch available
- Medium4.3Missing Authorization
Stock Locations for WooCommerce
≤3.1.8Update to 3.1.9
- High7.2Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.3.4.2Update to 4.3.4.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter
WP Cost Estimation & Payment Forms Builder
≤10.5.97Update to 10.6.1
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Social Login, Social Sharing by miniOrange
<7.8.0Update to 7.8.0
- Medium5.3Missing Authorization
Extra Product Options Builder for WooCommerce
≤1.2.167Update to 1.2.168
- High7.5Unauthenticated Arbitrary File Download
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.55.0.2Update to 1.55.1
- Medium5.3Missing Authorization
FundEngine – Donation and Crowdfunding Platform
≤1.7.6Update to 1.7.7
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤2.0.8Update to 2.0.9
- Medium6.1Reflected Cross-Site Scripting
Bopo – WooCommerce Product Bundle Builder
≤1.2.0Update to 1.2.1
- Medium4.3Missing Authorization
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤2.22.5Update to 2.22.6
- High7.2Unauthenticated Stored Cross-Site Scripting
SiteGround Email Marketing
≤1.7.5Update to 1.7.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation
Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration
≤3.4Update to 3.4.1
- Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
Flexible Refund for WooCommerce – EU One Click Return
≤1.0.51Update to 1.0.52
- Medium5.3Missing Authorization
Event Tickets Manager for WooCommerce
≤1.5.5Update to 1.5.6
- High7.5Unauthenticated SQL Injection
Simple Business Directory Pro
≤15.9.4Update to 15.9.5
- Critical9.8Unauthenticated Privilege Escalation via Password Reset
ProfileGrid – User Profiles, Groups and Communities
≤5.9.9.6Update to 5.9.9.7
- Medium6.1Reflected Cross-Site Scripting
Message Filter for Contact Form 7
≤1.6.3.8Update to 1.6.3.9
- Medium4.3Missing Authorization
Open Shop
≤1.7.1Update to 1.7.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Author Box WP Lens
≤2.1.5Update to 2.1.6
- Medium5.3Missing Authorization
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
≤4.6.9Update to 4.7.0