Database
WordPress Vulnerability Database (page 223)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
WowAddons – Product Addons and Product Options With Custom Fields
≤1.6.14Update to 1.6.15
- Medium5.3Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.8.1Update to 3.8.2
- Medium5.3Missing Authorization
ApplyOnline – Application Form Builder and Manager
≤2.6.7.6Update to 2.6.8
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Enable Media Replace
≤4.2.1Update to 4.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
MoreConvert Wishlist for WooCommerce
≤1.9.19Update to 1.9.20
- High7.2Unauthenticated Stored Cross-Site Scripting
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤2.3.10Update to 2.3.11
- Medium5.3Missing Authorization
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
≤2.2.0Update to 2.2.1
- High7.2PRO <= 2.10.8 - Unauthenticated Stored Cross-Site Scripting
Module PRO
≤2.10.8Update to 2.10.9
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.4.2Update to 5.4.3
- High7.2Unauthenticated Stored Cross-Site Scripting
HandL UTM Grabber / Tracker
≤2.9.2Update to 2.9.3
- High7.2Unauthenticated Stored Cross-Site Scripting
eCommerce Product Catalog
≤3.5.4Update to 3.5.5
- Medium5.3Missing Authorization to Unauthenticated Booking Approval
Timetics – Appointment Booking Calendar & Scheduling
≤1.0.56Update to 1.0.57
- Medium6.1Reflected Cross-Site Scripting
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.3.2Update to 8.3.3
- High8.8Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.3Update to 5.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute
WP Photo Album Plus
≤9.1.13.005Update to 9.2.01.001
- High7.2Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.2.2Update to 9.2.3
- Medium6.1Reflected Cross-Site Scripting via 'layoutstyle' Parameter
VikBooking Hotel Booking Engine & PMS
≤1.8.12Update to 1.8.13
- Medium6.5Authenticated (Staff+) SQL Injection via 's' Parameter
MotoPress Appointment Booking
≤2.4.5Update to 2.4.6
- High8.8Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.1Update to 6.0.9.2
- Medium4.3Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
≤4.9.8Update to 4.9.9
- Critical9.8Unauthenticated Privilege Escalation via Arbitrary Password Reset
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.5Update to 3.9.6
- Medium4.3Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
Qi Blocks
≤1.4.9Update to 1.5.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
Motors – Car Dealership & Classified Listings Plugin
≤1.4.111Update to 1.4.112
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.0Update to 4.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Download Manager
≤3.3.60Update to 3.3.61
- High8.8Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint
Dokan Pro
≤5.0.4Update to 5.0.5
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.14.1Update to 3.14.2
- High7.5Unauthenticated SQL Injection via 'store_service_date' Parameter
BookingPress Appointment Booking Pro
≤5.7.1Update to 5.7.2
- Medium4.3Cross-Site Request Forgery
GiveWP – Donation Plugin and Fundraising Platform
≤4.15.3Update to 4.15.4
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
Appointment Booking Calendar
≤1.4.02Update to 1.4.03