Database
WordPress Vulnerability Database (page 235)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to Settings Update
MP Customize Login Page
≤1.0No patch available
- Critical9.8Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter
Invoice Generator
≤1.0.0No patch available
- Critical9.8Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover
SignUp & SignIn
≤1.0.0No patch available
- High7.5Unauthenticated SQL Injection
ClearSale Total
≤3.4.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments
Cincopa video and media plug-in
≤1.163Update to 1.164
- High7.2Unauthenticated Stored Cross-Site Scripting
Email JavaScript Cloak
≤1.03No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets
Xpro Addons — 150+ Widgets for Elementor
≤1.7.2Update to 1.7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'value' Parameter
ARforms
≤7.1.1Update to 7.1.2
- High7.5Unauthenticated SQL Injection
Library Management System
≤3.5.7Update to 3.5.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Ultimate Before After Image Slider & Gallery – BEAF
≤4.7.0Update to 4.7.1
- Medium5.3Unauthenticated Payment Amount Bypass
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.11.0Update to 2.11.1
- Medium5.3Missing Authorization
CorvusPay WooCommerce Payment Gateway
≤2.7.4Update to 2.7.5
- High8.8Authenticated (Customer+) Arbitrary File Upload
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤8.0.1Update to 8.0.2
- High7.5Authenticated (Subscriber+) PHP Object Injection
BuddyBoss Platform
≤3.0.4Update to 3.0.5
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
Word Count and Social Shares
≤1.0No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Themify Popup
≤1.4.3Update to 1.4.4
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
utm.codes
≤1.9.0Update to 1.9.1
- Critical9.8Unauthenticated Account Takeover via OTP Brute Force
Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect
<1.4.1Update to 1.4.1
- High8.8Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.11.4Update to 2.12.0
- Medium5.3Missing Authorization
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
≤6.1.1Update to 6.1.2
- Critical9.8Unauthenticated Privilege Escalation
Paytium: Mollie payment forms & donations
≤5.0.2Update to 5.0.3
- Medium5.3Missing Authorization
BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection
≤5.0.3Update to 5.0.4
- Critical9.8Unauthenticated Privilege Escalation
Dokan Pro
≤5.0.4Update to 5.0.5
- High7.5Unauthenticated SQL Injection
워드프레스 결제 심플페이 – 우커머스 결제 플러그인
≤5.5.6Update to 5.5.7
- High8.1Unauthenticated PHP Object Injection
Newsletters
≤4.14Update to 4.15
- High8.1Unauthenticated PHP Object Injection
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.3.1.2Update to 7.3.1.3
- High7.2Authenticated (Editor+) Arbitrary File Write
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.5.4Update to 3.5.5
- High8.8Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute
AdRotate Banner Manager
≤5.17.7Update to 5.17.8
- Medium4.3Authenticated (Subscriber+) Account Takeover
WP 2FA – Two-factor authentication for WordPress
≤3.1.1.1Update to 3.1.1.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Email Disclosure
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.4Update to 2.5.5