Database
WordPress Vulnerability Database (page 214)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.3Update to 5.6.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.11Update to 2.8.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Active Woot Products Tables for WooCommerce. 100% FREE
≤1.1.0Update to 1.1.1
- High8.1Unauthenticated PHP Object Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.3.6Update to 7.3.7
- Medium5.3Two-Factor Authentication Bypass
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
<1.2.67Update to 1.2.67
- High7.2Unauthenticated Stored Cross-Site Scripting
picu – Online Photo Proofing Gallery
≤3.5.1Update to 3.6.1
- Medium5.31.0.17 - Unauthenticated Information Exposure
ShinyStat Analytics
1.0.12 – 1.0.17Update to 1.0.17
- Medium6.4Authenticated (Subscriber+) Server-side Request Forgery
PDF Generator for WordPress
≤1.6.2Update to 1.6.3
- High7.2Unauthenticated Stored Cross-Site Scripting
coaching
≤3.9.2Update to 3.9.3
- Medium5.3Missing Authorization
Event Tickets and Registration
≤5.28.5Update to 5.28.5.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
AI ChatBot for WooCommerce – WoowBot
≤4.6.1Update to 4.7.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Proxy & VPN Blocker
≤3.5.8Update to 3.5.9
- Medium5.3Missing Authorization
Peach Payments Gateway
≤4.0.2Update to 4.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
CF7 Views – Complete Entry Management for Contact Form 7
≤3.2.2Update to 3.2.3
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
Instant AI Image Generator – Create & Import Images
≤2.1.4Update to 2.1.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Tangible: Loops & Logic
≤4.2.3Update to 4.2.4
- High7.2WordPress Posts Bulk Editor and Manager <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.0.0Update to 1.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.55.0.1Update to 1.55.0.2
- High7.5Unauthenticated SQL Injection
Booking for Appointments and Events Calendar – Amelia
≤2.4.2Update to 2.4.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Newsletters
≤4.14Update to 4.15
- High8.8Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form
Divi Form Builder
≤5.1.8Update to 5.1.9
- High7.2Unauthenticated Stored Cross-Site Scripting
GD Security Headers
≤1.8Update to 1.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD
≤3.1.57Update to 3.1.58
- High8.8Authenticated (Contributor+) Privilege Escalation
MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
≤2.0.2Update to 2.0.3
- Medium5.3Missing Authorization
Razorpay Payment Links for WooCommerce
≤2.1.4Update to 2.1.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Wishlist Member X
≤3.32.0Update to 3.33.0
- Medium6.6Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.12.7Update to 3.12.8
- Medium5.3Missing Authorization
Recarto – Abandoned Cart Recovery for WooCommerce
≤1.1.12Update to 1.1.13
- Medium5.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.6.9Update to 2.7.0
- Medium4.3Missing Authorization
Sprout Invoices – Client Invoicing & Estimates
≤20.8.13Update to 20.8.14