Database
WordPress Vulnerability Database (page 217)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Cashier+) SQL Injection
Vitepos – Point of Sale (POS) for WooCommerce
≤3.4.2Update to 3.4.3
- Medium4.3Missing Authorization
WP Booking System – Booking Calendar Premium
<5.12.8.1Update to 5.12.8.1
- Critical9.8Unauthenticated Remote Code Execution via 'postData' Parameter
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.12.7Update to 3.12.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Exclusive Addons for Elementor
≤2.7.9.8Update to 2.7.9.9
- Medium5.8Open Redirect
Contact Form 7 – PayPal & Stripe Add-on
≤2.4Update to 2.5
- Medium6.1Reflected Cross-Site Scripting
Document Gallery
≤5.1.0Update to 5.1.1
- Medium5.3Missing Authorization to Unauthenticated User Session Termination
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.3.0Update to 2.3.1
- Medium4.3Missing Authorization
Download Manager
≤3.3.61Update to 3.3.62
- High7.5Unauthenticated SQL Injection
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.12Update to 6.0.13
- Medium5.3Missing Authorization to Unauthenticated Media Attachment Deletion
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
<4.3.8Update to 4.3.8
- High8.1Unauthenticated PHP Object Injection
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.12Update to 6.0.13
- Critical9.8Unauthenticated Arbitrary File Upload
Realtyna Organic IDX plugin + WPL Real Estate
≤5.2.0Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.11Update to 6.0.12
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
reCAPTCHA for Asgaros Forum
≤1.1.0Update to 1.1.1
- Medium5.3Missing Authorization
The Events Calendar
≤6.16.5.0Update to 6.16.5.1
- Medium6.5Missing Authorization Unauthenticated Information Exposure
BookingPress Appointment Booking Pro
≤5.7.2Update to 5.7.3
- Medium5.3Uanuthenticated Payment Bypass
Payment Plugins for PayPal WooCommerce
≤2.0.19Update to 2.0.20
- Medium4.3Unauthenticated Insecure Direct Object Reference
Tutor LMS – eLearning and online course solution
≤3.9.13Update to 3.9.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Calendar
≤1.3.17Update to 1.3.18
- Critical9.8Unauthenticated Privilege Escalation
Custom Fields Account Registration For Woocommerce
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
Flatsome
≤3.20.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
tagDiv Cloud Library
≤3.9.5Update to 3.9.6
- Medium5.3Unauthenticated Payment Bypass
Clover Payment Gateway by Zaytech for WooCommerce
≤1.3.5Update to 1.3.6
- Medium5.3Missing Authorization
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1
- Medium6.1Reflected Cross-Site Scripting
tagDiv Composer
≤5.4.5Update to 5.4.6
- High7.2Unauthenticated Stored Cross-Site Scripting
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤10.11.0Update to 10.11.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)
≤8.91.0Update to 8.92.0
- Medium6.1Reflected Cross-Site Scripting
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.1.7Update to 4.1.8
- High7.5Unauthenticated SQL Injection
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤10.11.0Update to 10.11.1
- High7.5Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload
AMP for WP – Accelerated Mobile Pages
≤1.1.12Update to 1.1.13