Database
WordPress Vulnerability Database (page 238)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Vitepos – Point of Sale (POS) for WooCommerce
≤3.4.2Update to 3.4.3
- Medium5.3Insecure Direct Object Reference to Unauthenticated Support Ticket Access
WP Support Plus Responsive Ticket System
≤9.1.2No patch available
- Medium5.3Unauthenticated Information Exposure
Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups
≤2.0.9Update to 2.0.10
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Bricksable for Bricks Builder
≤1.6.83Update to 1.6.84
- High7.5Unauthenticated SQL Injection
Premmerce Wishlist for WooCommerce
≤1.1.11Update to 1.1.12
- High7.2Unauthenticated Server-Side Request Forgery
Fediverse Embeds
≤1.5.7Update to 1.5.8
- Medium5.3Missing Authorization
Newsletters
≤4.13Update to 4.14
- Medium4.3Missing Authorization
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP
≤1.4.25Update to 1.4.26
- High8.1Unauthenticated Local File Inclusion
MDTF – Meta Data and Taxonomies Filter
≤1.3.8Update to 1.3.9
- Medium5.3Missing Authorization
Intranet & Private Site – All-In-One Intranet
≤1.8.1Update to 1.9.0
- Medium5.3Unauthenticated Missing Authorization
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.4.0Update to 3.5.0
- High7.2Unauthenticated Server-Side Request Forgery
Fediverse Embeds
≤1.5.7Update to 1.5.8
- Medium6.5Authenticated (Subscriber+) SQL Injection
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
≤2.6.8Update to 2.6.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute
Slideshow Gallery LITE
≤1.8.5Update to 1.8.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Fancy Testimonials
≤1.0No patch available
- High7.2Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
CF7 to Webhook
≤5.0.0Update to 5.0.1
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
Appointment Booking Calendar
≤1.4.01Update to 1.4.02
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field
PowerPress Podcasting plugin by Blubrry
≤11.16.8Update to 11.16.9
- Low2.7Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.63Update to 1.2.64
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
SysBasics Customize My Account for WooCommerce – Live My Account Customizer
≤4.3.6Update to 4.3.7
- Medium6.1Reflected Cross-Site Scripting via 'tab' Parameter
SysBasics Customize My Account for WooCommerce – Live My Account Customizer
≤4.3.6Update to 4.3.7
- Medium4.9Authenticated (Administrator+) SQL Injection via 'data' Parameter
Tutor LMS – eLearning and online course solution
≤3.9.11Update to 3.9.12
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook
Simple Membership
≤4.7.5Update to 4.7.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute
Services Section Block – present your services in clean grids and columns
≤1.4.4Update to 1.4.5
- Medium4.3Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' Parameters
PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin
≤2.3.0Update to 2.3.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
≤3.0.6Update to 3.0.7
- Medium4.9Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter
Advanced Order Export For WooCommerce
≤4.0.10Update to 4.1.0
- High8.8Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action
Offload, AI & Optimize with Cloudflare Images
≤1.10.2Update to 1.10.3
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.5Update to 3.7.6
- Medium4.9Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.43Update to 1.15.44