Database
WordPress Vulnerability Database (page 232)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Insecure Direct Object Reference
Toolset Forms
≤2.6.24Update to 2.6.25
- Critical9.8Unauthenticated Arbitrary File Upload via @import URL Reflection
OMGF Pro
≤5.2.6Update to 5.2.7
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Happy Coders OTP Login for WooCommerce
≤2.7Update to 2.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Basic Contact Form
≤20250114No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payment Gateway Based Fees and Discounts for WooCommerce
≤3.0.0Update to 3.1.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Post Duplicator
<3.0.15Update to 3.0.15
- High8.8Authenticated (Subscriber+) Arbitrary File Deletion
JS Help Desk – AI-Powered Support & Ticketing System
≤3.1.1Update to 3.1.2
- High7.5Unauthenticated SQL Injection
Advance Product Search- Voice & Ajax Search for WooCommerce
≤1.4.4Update to 1.4.5
- Medium4.9Authenticated (Editor+) SQL Injection
Infility Global
<2.15.20Update to 2.15.20
- High8.8WordPress Form Builder <= 2.23.0 - Authenticated (Subscriber+) Arbitrary File Upload
Quform - WordPress Form Builder
≤2.23.0Update to 2.23.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Blog2Social: Social Media Auto Post & Scheduler
≤8.9.2Update to 8.9.3
- Medium4.3Authenticated (Subscriber+) Arbitrary File Upload
Travel Booking
≤2.2.5Update to 2.2.6
- High7.5Unauthenticated SQL Injection
JetSmartFilters
≤3.8.3Update to 3.8.3.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.2.2Update to 4.2.3
- High8.8Authenticated (Contributor+) Remote Code Execution
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.0.19Update to 4.1.0
- Medium4.3Missing Authorization
Cornerstone
<7.8.9Update to 7.8.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Woodmart
≤8.5.3Update to 8.5.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Featured Image
≤2.1Update to 2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SeedProd Pro
<6.19.5Update to 6.19.5
- Medium5.3Missing Authorization
PPOM – Product Addons & Custom Fields for WooCommerce
≤33.0.18Update to 34.0.0
- High7.5Authenticated (Subscriber+) PHP Object Injection
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.3.4.1Update to 4.3.4.2
- Low2.7Missing Authorization to Authenticated (Editor+) Settings Update
Site Kit by Google – Analytics, Search Console, AdSense, Speed
<1.176.0Update to 1.176.0
- Medium5.3Missing Authorization
SiteGround Email Marketing
≤1.7.5Update to 1.7.6
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.4Update to 2.5.5
- Critical9.8Unauthenticated Privilege Escalation via Weak Recovery Link
Abandoned Cart Lite for WooCommerce
≤6.8.1Update to 6.8.2
- High7.5Authenticated (Subscriber+) PHP Object Injection
Uncanny Automator Pro
≤7.3.0.6Update to 7.3.0.7
- Medium5.3Missing Authorization to Unauthenticated File Download
Frontend File Manager Plugin
≤23.6No patch available
- Medium4.3Cross-Site Request Forgery
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.2Update to 5.6.3
- Medium4.3Missing Authorization
SEOPress PRO
≤9.1.1Update to 9.2
- Medium6.1Reflected Cross-Site Scripting
TablePress – Tables in WordPress made easy
≤3.3.1Update to 3.3.2