Database
WordPress Vulnerability Database (page 236)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.2Update to 5.2.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content
ProfileGrid – User Profiles, Groups and Communities
≤5.9.9.2Update to 5.9.9.3
- Medium5.3Missing Authorization
Pie Register – User Registration, Profiles & Content Restriction
<3.8.4.10Update to 3.8.4.10
- Medium4.3Cross-Site Request Forgery
Motors – Car Dealership & Classified Listings Plugin
<1.4.110Update to 1.4.110
- Medium4.3Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.4Update to 2.5.5
- High8.1Unauthenticated PHP Object Injection
Database for Contact Form 7, WPforms, Elementor forms
≤1.5.1Update to 1.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Breeze Cache
≤2.5.5Update to 2.5.6
- Medium4.3Authenticated (Subscriber+) Information Disclosure
Tutor LMS – eLearning and online course solution
≤3.9.12Update to 3.9.13
- High7.5Unauthenticated SQL Injection
Library Management System
≤3.5.7Update to 3.5.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Comment Creation
Tutor LMS – eLearning and online course solution
≤3.9.12Update to 3.9.13
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
Tutor LMS
≤3.9.12Update to 3.9.13
- Medium5.3Unauthenticated PayPal Bypass to Membership Activation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.1Update to 5.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Transbank Webpay
<1.14.0Update to 1.14.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Membership Tier Modification
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.1Update to 5.2.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification
Tutor LMS – eLearning and online course solution
≤3.9.12Update to 3.9.13
- Medium6.5Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute
Simple File List
≤6.3.7Update to 6.3.8
- High7.5Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
Simple File List
≤6.3.7Update to 6.3.8
- High7.5Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
Simple File List
≤6.3.7Update to 6.3.8
- High8.1Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
Database for Contact Form 7, WPforms, Elementor forms
≤1.5.1Update to 1.5.2
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Branda – White Label & Branding, Free Login Page Customizer
≤3.4.29Update to 3.4.31
- Medium5.3Unauthenticated Arbitrary Record Creation
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤10.1.01Update to 10.1.02
- Medium4.3Missing Authorization
UPI QR Code Payment Gateway for WooCommerce
≤1.6.2Update to 1.6.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
License Manager for WooCommerce
≤3.0.15Update to 3.0.16
- Medium4.3Missing Authorization
WP Hotel Booking
<2.3.1Update to 2.3.1
- Medium5.3Missing Authorization
Paymob for WooCommerce
≤4.1.10Update to 4.1.11
- High7.2Unauthenticated Stored Cross-Site Scripting
Master Slider – Responsive Touch Slider
≤3.11.2No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Activity Log
≤5.6.3.1Update to 5.6.4
- Medium5.3Unauthenticated Open Registration
LA-Studio Element Kit for Elementor
≤1.6.0Update to 1.6.1
- High8.8Authenticated (Subscriber+) Privilege Escalation
Abandoned Cart Pro for WooCommerce
≤10.4.0Update to 10.4.1
- Medium5.3Missing Authorization
CheckView – Form & Checkout Testing
≤2.1.0Update to 2.2.0