Database
WordPress Vulnerability Database (page 240)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Motors – Car Dealership & Classified Listings Plugin
≤1.4.109Update to 1.4.110
- High7.5Unauthenticated SQL Injection
wpDataTables (Premium)
≤7.4Update to 7.4.1
- High7.5Unauthenticated SQL Injection
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.162Update to 2.8.163
- High8.8Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤30.0.2Update to 30.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤3.1Update to 3.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Permalink Manager Lite
≤2.5.3.3Update to 2.5.3.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Cornerstone
<7.8.8Update to 7.8.8
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.0.1Update to 3.6.1
- Medium5.3Missing Authorization
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.3Update to 3.9.4
- Medium5.3Backdoored Software
EscortWP
≤3.6.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.10Update to 3.8.10.1
- Medium6.6Authenticated (Administrator+) PHP Object Injection via Import
Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress
≤2.0.13Update to 2.0.14
- High8.8Authenticated (Subscriber+) Privilege Escalation
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.1Update to 3.6.1.1
- High7.5Unauthenticated SQL Injection
JobSearch WP Job Board
≤3.2.9Update to 3.3.0
- Critical9.8Unauthenticated Remote Code Execution
DoLeads Integrator
≤1.2.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.10Update to 3.8.10.1
- Critical9.8Maliciously Injected Backdoor
Uncanny Automator Pro
7.3.0.5 – 7.3.0.5Update to 7.3.0.6
- Medium4.3Missing Authorization
Melhor Envio
≤2.16.3Update to 2.16.4
- Medium4.3Authenticated (Subscriber+) Arbitrary Media File Move
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤6.8.0Update to 6.8.1
- Critical9.8Unauthenticated Privilege Escalation
Registration Form for WooCommerce
≤1.0.9Update to 1.1.0
- High8.8Authenticated (Subscriber+) Privilege Escalation
Falang multilanguage for WordPress
≤1.4.2Update to 1.4.3
- High8.1Unauthenticated PHP Object Injection
WP Activity Log
≤5.6.3.1Update to 5.6.4
- Medium6.1Reflected Cross-Site Scripting
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
≤6.2.9Update to 6.3.0
- High7.5Unauthenticated SQL Injection
Wp EMember
<v10.9.4Update to v10.9.4
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Avada (Fusion) Builder
≤3.15.4Update to 3.15.5
- Medium5.3Unauthenticated Insecure Direct Object Reference
Clean Login
≤1.15Update to 1.16
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.4Update to 3.9.5
- High7.5Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
JetEngine
≤3.8.10.1Update to 3.8.10.2
- Medium6.5Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
WooCommerce Stripe Payment Gateway
≤10.7.0Update to 10.8.0
- High7.5Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.5.1Update to 5.5.2