Database
WordPress Vulnerability Database (page 221)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Contributor+) SQL Injection
iNET Webkit
1.2.4 – 1.2.4No patch available
- High7.5Authenticated (Contributor+) Local File Inclusion
Struktur Core
≤2.5.1No patch available
- High7.5Hotel Booking WordPress <= 1.3.6 - Authenticated (Contributor+) Local File Inclusion
Nuss - Hotel Booking WordPress
≤1.3.6No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
GD Rating System
≤3.7Update to 3.7.1
- Medium5.3Missing Authorization
ez Form Calculator Premium
≤2.14.1.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Envision Page Builder – A collection of WordPress Gutenberg blocks & templates
≤0.22No patch available
- High7.5Authenticated (Contributor+) Local File Inclusion
aqua
≤5.1.2No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter
MotoPress Appointment Booking
≤2.4.4Update to 2.4.5
- High7.5Authenticated (Contributor+) Local File Inclusion
NewsPlus Shortcodes
≤4.2.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Surbma | Yoast SEO Breadcrumb Shortcode
≤1.2No patch available
- Medium5.3Missing Authorization
VW Food Corner
≤1.0.4Update to 1.0.5
- High7.5eSports and Gaming WordPress Theme <= 1.5 - Authenticated (Contributor+) Local File Inclusion
Overworld - eSports and Gaming WordPress Theme
≤1.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPBakery Page Builder Addons by Livemesh
≤3.9.4No patch available
- Medium4.3Cross-Site Request Forgery
ProfileGrid – User Profiles, Groups and Communities
≤6.0.0.2Update to 6.0.0.3
- Medium6.1Reflected Cross-Site Scripting
Post Status Notifier Lite
≤1.12.0Update to 1.13.0
- Medium5.3Missing Authorization
MeetingHub – Appointment Booking Calendar & Meetings with Zoom, Google Meet, Teams, Webex & Jitsi
≤1.26.4Update to 1.26.5
- High7.5Unauthenticated Arbitrary File Read via 's' Parameter
Perfmatters
≤2.6.4Update to 2.6.5
- Medium6.5Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'
Database for Contact Form 7, WPforms, Elementor forms
≤1.5.1Update to 1.5.2
- High7.5Unauthenticated SQL Injection via 'notinstring' Parameter
WP Review Slider Pro
≤12.7.2Update to 12.7.3
- High7.5File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
Ninja Forms - File Uploads
≤3.3.29Update to 3.3.30
- Medium5.3Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter
Appointment Bookings for Zoom GoogleMeet and more – Wappointment
≤2.7.6Update to 2.7.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.1Update to 5.2.2
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter
Product Video Gallery for Woocommerce
≤1.5.1.8Update to 1.5.1.9
- Medium6.5Authenticated (Custom+) SQL Injection via 'select' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5.8Update to 4.5.9
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
My Calendar – Accessible Event Manager
≤3.7.14Update to 3.7.15
- Medium5.3Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.2Update to 5.6.3
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.11Update to 6.0.12
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.11Update to 6.0.12
- Medium4.3Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.7.8Update to 5.7.9
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.3Update to 3.6.3.1