Database
WordPress Vulnerability Database (page 229)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.2.2Update to 9.2.3
- High8.8Authenticated (Contributor+) Remote Code Execution
Blocksy Companion Pro
≤2.1.45Update to 2.1.46
- Medium5.3Missing Authorization
GIFT4U – Gift Cards All in One for Woo
≤1.0.10Update to 1.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Simply Schedule Appointments
≤1.6.12.2Update to 1.6.12.4
- Medium6.5Authenticated (Contributor+) SQL Injection
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤30.0.0Update to 30.0.1
- Medium6.5Authenticated (Contributor+) SQL Injection
Recipe Cards For Your Food Blog from Zip Recipes
≤8.2.7Update to 8.2.8
- Medium4.3Missing Authorization
Email Marketing for WooCommerce by Omnisend
≤1.19.0Update to 1.19.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
JS Help Desk – AI-Powered Support & Ticketing System
≤3.1.0Update to 3.1.1
- Medium6.5Authenticated (Marketer+) SQL Injection via 'search' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5.5Update to 4.5.6
- Critical9.8Unauthenticated Privilege Escalation
AI Copilot – Content Generator
≤1.5.3Update to 1.5.4
- Medium5.3Unauthenticated Insecure Direct Object Reference
Blocksy Companion Pro
≤2.1.46Update to 2.1.47
- Medium4.3Missing Authorization
Shoppable Images (Lookbook) for WooCommerce
≤1.3Update to 1.3.1
- Medium6.1Reflected Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.3.2Update to 4.3.3
- Medium5.3Unauthenticated Information Exposure
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1062Update to 1.7.1063
- Medium6.5Authenticated (Contributor+) SQL Injection
wpForo Forum
≤3.0.9Update to 3.1.0
- Medium5.3Missing Authorization
PhonePe Payment Solutions
≤3.0.0Update to 3.1.0
- Medium5.3Unauthenticated Sensitive Information Exposure
WCBoost – Products Compare
≤1.1.0Update to 1.1.1
- Medium5.3Unauthenticated Sensitive Information Exposure
Bopo – WooCommerce Product Bundle Builder
≤1.1.6Update to 1.2.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
GravityView
≤3.0.0Update to 3.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps
≤2.1.1Update to 2.1.2
- Medium4.3Missing Authorization
Restaurant Menu and Food Ordering
≤2.4.11Update to 2.4.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
≤1.8.3Update to 1.8.4
- Medium4.9Authenticated (Administrator+) SQL Injection
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
≤4.0.1Update to 4.1.0
- Medium6.1Reflected Cross-Site Scripting via 'view' Parameter
MaxButtons – Create buttons
≤9.8.5Update to 9.8.6
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure
Site Reviews
≤8.0.11Update to 8.0.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Block Animations, Motion & Scroll Effects – Ghost Kit
≤3.6.0Update to 3.6.1
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure
GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO
≤4.4.2Update to 4.4.3
- Medium5.3Missing Authorization to Unauthenticated User Deletion via Stripe Handler
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.2Update to 5.2.3
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.11Update to 6.0.12
- Medium4.3Missing Authorization
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator
≤1.5.6Update to 1.5.9