Database
WordPress Vulnerability Database (page 237)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.97.3Update to 2.97.4
- Medium5.3Unauthenticated Arbitrary Webhook Creation via REST API Endpoint
STRABL – A checkout solution
≤4.5Update to 4.6
- Medium5.3Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload_email' Parameter
2Download Connector for 2DL Hosted Checkout
≤0.1.5Update to 0.1.6
- Critical9.8Unauthenticated Local File Inclusion via doc_style
BetterDocs Pro
≤3.8.0Update to 3.8.1
- Medium6.51.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source
Royal Addons for Elementor – Addons and Templates Kit for Elementor
1.7.1058 – 1.7.1059Update to 1.7.1060
- Critical9.1Unauthenticated Arbitrary File Deletion via Form Entry Value
Avada (Fusion) Builder
≤3.15.3Update to 3.15.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label
Creavi Appointment Booking Calendar
≤1.4.4Update to 1.4.5
- Medium4.9Authenticated (Administrator+) Arbitrary File Read via 'log_file' Parameter
Woosa – Marktplaats for WooCommerce
≤2.0.5Update to 2.0.6
- Medium5.3Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)
WP DSGVO Tools (GDPR)
≤3.1.39Update to 3.1.40
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API
Bogo
≤3.9.1Update to 3.9.2
- Medium6.5Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
≤2.8.7Update to 2.8.8
- Medium6.4Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter
Advanced Import
≤1.4.6Update to 2.0.0
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter
Blocksy Companion
≤2.1.45Update to 2.1.46
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.5.3Update to 4.5.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.4.2Update to 5.4.3
- Medium4.3Cross-Site Request Forgery
User Admin Simplifier
≤3.0.0Update to 3.0.1
- Medium5.3Unauthenticated Information Exposure
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.3Update to 4.7.4
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Disclosure
WP DSGVO Tools (GDPR)
≤3.1.39Update to 3.1.40
- Medium6.5Authenticated (Contributor+) SQL Injection
Media Library Assistant
≤3.35Update to 3.36
- Medium5.3Missing Authorization
Syncee Premium Dropshipping & Wholesale
≤1.0.27Update to 1.0.28
- Medium4.3Cross-Site Request Forgery
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.0Update to 4.5.1
- Critical9.8Backdoor
Enable CORS
≤2.0.3Update to 2.0.4
- Medium4.4Authenticated (Shop manager+) Stored Cross-Site Scripting
Ocean Product Sharing
≤2.2.2Update to 2.2.3
- Medium5.3Missing Authorization
Five Star Restaurant Menu and Food Ordering
≤2.5.2Update to 2.5.3
- Medium5.3Unauthenticated Information Exposure
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.4.0Update to 3.5.0
- High7.5Unauthenticated SQL Injection
YMC Filter
≤3.11.5Update to 3.11.6
- Medium6.1Reflected Cross-Site Scripting
Interactive Content – H5P
≤1.17.6Update to 1.17.7
- High8.8Authenticated (Contributor+) Privilege Escalation
Avada (Fusion) Builder
≤3.15.4Update to 3.15.5
- Medium5.3Missing Authorization
Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator
≤8.3.9Update to 8.3.10
- High7.5Unauthenticated SQL Injection
MDTF – Meta Data and Taxonomies Filter
≤1.3.7Update to 1.3.8