Database
WordPress Vulnerability Database (page 239)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Authenticated (Administrator+) SQL Injection via 'name' Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.43Update to 1.15.44
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints
Event Koi Lite – Events Calendar, Event Tickets, RSVP & Registration
≤1.3.13.1Update to 1.3.14.0
- Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
≤1.42.1Update to 1.43.0
- High8.8Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter
E2Pdf – Export Pdf Tool for WordPress
≤1.32.26Update to 1.32.31
- Medium4.3Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.3Update to 5.0.4
- High7.5Authenticated (Subscriber+) Local File Inclusion
Motors – Car Dealership & Classified Listings Plugin
≤1.4.109Update to 1.4.110
- Medium5.3Unauthenticated Information Exposure
Quads Ads Manager for Google AdSense
≤3.0.3Update to 3.0.4
- Medium5.3Missing Authorization
Five Star Restaurant Reservations – WordPress Booking Plugin
≤2.7.19Update to 2.7.20
- High7.5Unauthenticated SQL Injection
JetBooking
≤4.0.4.1Update to 4.0.4.2
- High7.5Unauthenticated SQL Injection
WP Travel Gutenberg Blocks
≤3.9.4Update to 3.9.5
- High8.1Unauthenticated PHP Object Injection
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
≤1.5.5Update to 1.5.6
- Medium5.3Information Exposure
Object Cache 4 everyone
≤2.3.2Update to 2.3.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
Manago AI & Leadoo AI
≤3.11.2Update to 3.11.3
- High7.5Unauthenticated SQL Injection
Real Estate 7 WordPress
≤3.5.9Update to 3.6.0
- High7.5Unauthenticated SQL Injection
Motors – Car Dealership & Classified Listings Plugin
≤1.4.109Update to 1.4.110
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure
Visual Link Preview
≤2.3.1Update to 2.4.0
- Medium5.3Missing Authorization
MStore API – Create Native Android & iOS Apps On The Cloud
≤4.18.4Update to 4.19.0
- High8.3Authenticated (Contributor+) Remote Code Execution
Advanced Ads – Ad Manager & AdSense
≤2.0.21Update to 2.0.22
- High7.5Unauthenticated SQL Injection
Cargo Shipping Location for WooCommerce
≤5.6Update to 5.7
- Medium5.3Unauthenticated Sensitive Information Exposure in 'form_id' Parameter
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
≤3.1.7Update to 3.1.8
- Medium6.5Authenticated (Subscriber+) SQL Injection
SureDash – Community, Courses & Member Dashboard
≤1.8.0Update to 1.8.1
- Medium5.3Missing Authorization
Gutenverse Companion
≤2.5.0Update to 2.5.1
- Medium4.3Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.6Update to 4.2.7
- Medium6.5Authenticated (Subscriber+) SQL Injection
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.4.11Update to 5.4.12
- High8.8Authenticated (Contributor+) Remote Code Execution
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets
≤4.2.3Update to 4.2.4
- Medium5.3Missing Authorization
Nexi XPay
≤8.3.1Update to 8.3.2
- High7.5Unauthenticated SQL Injection
WP Photo Album Plus
≤9.1.13.005Update to 9.2.01.001
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
≤3.4.6Update to 3.4.7
- High7.5Unauthenticated SQL Injection
GIFT4U – Gift Cards All in One for Woo
≤1.0.10Update to 1.1.0
- High7.5Unauthenticated SQL Injection
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤5.4.0Update to 5.5.0