Database
WordPress Vulnerability Database (page 233)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Cornerstone
<7.8.8Update to 7.8.8
- Medium6.1Reflected Cross-Site Scripting
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.15.0.5Update to 3.15.0.6
- Medium5.3Unauthenticated Arbitrary File Deletion
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
≤3.11.4Update to 3.11.5
- Medium4.3Missing Authorization
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.14Update to 3.0.15
- High7.2Authenticated (Admin+) Arbitrary File Upload
TemplateSpare – No-Code Website Templates, Demo Importer & Site Migration for News, Magazine & Blog
≤4.2.0Update to 4.2.1
- Medium5.3Unauthenticated Payment Bypass
Integrate PhonePe with WooCommerce
≤1.2.1No patch available
- High7.5Unauthenticated SQL Injection
Quotes llama
≤3.1.5Update to 3.1.6
- Medium6.5Authenticated (Subscriber+) SQL Injection
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤2.22.5Update to 2.22.6
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
Elementor Website Builder – more than just a page builder
≤4.1.3Update to 4.1.4
- Medium6.1Reflected Cross-Site Scripting
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.4.8Update to 3.5.0
- Medium5.3Unauthenticated Information Exposure
Print Invoice & Delivery Notes for WooCommerce
≤7.1.1Update to 7.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
AI Summaries & Share Buttons
<2.0.4Update to 2.0.4
- High7.5Unauthenticated SQL Injection via 'post_id' Parameter
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤2.22.7Update to 2.22.8
- Medium6.5Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'
Gravity Bookings
≤2.7.1Update to 2.7.2
- High7.5Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters
Dokan Pro
≤5.0.4Update to 5.0.5
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
Dokan Pro
≤5.0.4Update to 5.0.5
- Medium6.4Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤6.1.4Update to 6.2.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Post Metadata Disclosure
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.16Update to 2.4.17
- Medium6.1Reflected Cross-Site Scripting
Quick Interest Slider
≤3.1.6Update to 3.1.7
- High8.8Authenticated (Contributor+) Privilege Escalation
Frisbii Pay
≤1.8.2Update to 1.8.2.1
- Medium5.3Missing Authorization to Unauthenticated Media File Upload
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.16Update to 2.4.17
- High7.2Unauthenticated Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.53.1Update to 1.53.2
- Medium4.9Authenticated (Administrator+) SQL Injection
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.15.0.5Update to 3.15.0.6
- Medium6.4WordPress Directory & Listing Theme <= 2.9.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
ListingPro - WordPress Directory & Listing Theme
≤2.9.11Update to 2.9.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Gutenverse Form – Contact Form Builder, Block Form & Booking Form
≤2.4.7Update to 2.5.0
- High7.5Unauthenticated SQL Injection
Quotes llama
≤3.1.5Update to 3.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Responsive Lightbox & Gallery
≤2.7.6Update to 2.7.7
- Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
Advanced Order Export For WooCommerce
≤4.0.9Update to 4.0.10
- Critical9.8Unauthenticated Administrator Account Creation
Shibboleth
≤2.5.3Update to 2.5.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Customer Reviews for WooCommerce
≤5.110.1Update to 5.111.0