Database
WordPress Vulnerability Database (page 228)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
≤3.11.3Update to 3.11.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.22Update to 6.4.23
- Medium5.3Missing Authorization
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.11Update to 6.0.12
- Medium6.5Authenticated (Contributor+) SQL Injection
Custom Field Template
≤2.7.8Update to 2.8
- Medium4.3Missing Authorization
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More
≤6.2.1Update to 6.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Real Estate 7 WordPress
≤3.5.9Update to 3.6.0
- Medium5.3Unauthenticated HTML Injection
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.11Update to 6.0.12
- High7.5Unauthenticated SQL Injection
Modern Events Calendar Lite
≤7.33.0Update to 7.34.0
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
Frontend File Manager Plugin
≤23.6No patch available
- Medium5.3Missing Authorization to Unauthenticated Sensitive User Information Disclosure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.6Update to 4.3.7
- Medium6.5Authenticated (Contributor+) SQL Injection
nicen-localize-image
≤1.4.9No patch available
- Medium5.3Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.8.6Update to 6.0.8.7
- Medium5.3Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤8.4.3Update to 8.5.0
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.1.4Update to 11.1.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actions
Product Specifications for Woocommerce
≤0.8.9Update to 0.8.10
- Medium4.3Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.2.1Update to 2.3.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.4Update to 5.0.5
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.4Update to 5.0.5
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤3.8.0Update to 3.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Surbma | Infusionsoft Shortcode
≤2.0.1Update to 2.0.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation
Spexo
≤2.0.11Update to 2.0.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter
Page Builder by SiteOrigin
≤2.34.3Update to 2.34.4
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.2.2Update to 9.2.3
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter
Invoice Generator
≤1.0.0No patch available
- Medium6.5Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5.5Update to 4.5.6
- Medium6.4Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta
CodePeople Post Map for Google Maps
≤1.2.6Update to 1.2.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings
Ivory Search – WordPress Search Plugin
≤5.5.15Update to 5.5.16
- Medium4.32.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers
HD Quiz
2.2.0 – 2.2.1Update to 2.2.2
- Medium6.5Authenticated (Sales representative+) SQL Injection
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5Update to 4.5.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Auros Core
≤5.3.1No patch available