Database
WordPress Vulnerability Database (page 231)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Eagle Booking
≤1.3.4.3No patch available
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.1.7Update to 1.1.8
- Medium6.5Authenticated (Contributor+) SQL Injection
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress
≤4.7.8Update to 4.7.9
- Medium4.3Cross-Site Request Forgery
Abandoned Cart Lite for WooCommerce
≤6.8.0Update to 6.8.1
- Medium6.5Authenticated (Contributor+) SQL Injection
Restaurant Menu and Food Ordering
≤2.4.10Update to 2.4.11
- Medium4.9Authenticated (Administrator+) SQL Injection
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
≤6.0.1Update to 6.0.2
- Medium4.3Missing Authorization
Forget About Shortcode Buttons
≤2.1.3No patch available
- High8.1Unauthenticated Privilege Escalation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.2Update to 5.2.3
- Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.30Update to 3.7.31
- Medium6.5Missing Authorization to Unauthenticated Payment Bypass
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.0Update to 5.2.1
- Medium6.5Authenticated (Custom+) SQL Injection via 'after' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5.4Update to 4.5.5
- Medium4.3Authenticated (Contributor+) Information Exposure
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.0.8Update to 2.0.9
- High7.2Unauthenticated Stored Cross-Site Scripting
WordPress Automatic Plugin
<3.135.1Update to 3.135.1
- High7.5Unauthenticated SQL Injection
JetEngine
≤3.8.10.2Update to 3.8.11
- High7.2Unauthenticated Stored Cross-Site Scripting
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.5.4Update to 4.5.5
- Medium6.5Authenticated (Admin+) Arbitrary File Deletion
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.15.0.5Update to 3.15.0.6
- Medium5.3Missing Authorization
Block for Mailchimp – grow your email list with signup forms
≤1.1.15Update to 1.1.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Header Footer Builder for Elementor
≤1.2.0Update to 1.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Neve PRO
≤3.1.2Update to 3.1.3
- Medium6.1Reflected Cross-Site Scripting
Perfmatters
≤2.6.3Update to 2.6.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Infility Global
<2.15.19Update to 2.15.19
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Chatbot Discussion Disclosure
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.5.4Update to 3.5.5
- High7.2Unauthenticated Stored Cross-Site Scripting
FOX – Currency Switcher Professional for WooCommerce
≤1.4.8Update to 1.4.9
- Medium5.3Missing Authorization
Subscriptions for WooCommerce
≤1.9.5Update to 1.9.6
- Medium4.3Missing Authorization
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
≤4.6.2Update to 4.7.0
- Medium4.3Missing Authorization
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.0.8Update to 2.0.9
- High7.5Real Estate WordPress Theme <= 4.5.3 - Authenticated (Subscriber+) PHP Object Injection
RH - Real Estate WordPress Theme
≤4.5.3Update to 4.5.4
- Medium5.3Unauthenticated Payment Bypass
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.32.0Update to 6.32.1
- High8.8Authenticated (Subscriber+) Privilege Escalation
Redux Framework
≤4.5.12Update to 4.5.13
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Frontend File Manager Plugin
≤23.6No patch available