Database
WordPress Vulnerability Database (page 241)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter
WP Review Slider Pro
≤12.6.8Update to 12.7.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter
User Private Files – Secure File Sharing and Client Portal Plugin
≤2.1.6Update to 2.1.7
- High8.8Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter
WP Review Slider Pro
≤12.6.8Update to 12.7.0
- Medium6.5Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.0.7Update to 2.0.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.62Update to 51.1.63
- High8.8Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
WP Review Slider Pro
≤12.6.8Update to 12.7.0
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute
Static Block
≤2.2No patch available
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter
Abandoned Contact Form 7
≤2.2No patch available
- High8.8Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation
Premmerce Dev Tools
≤2.0No patch available
- Medium5.3Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action
Video Conferencing with Zoom
≤4.6.7Update to 4.6.8
- High7.5Unauthenticated SQL Injection
GEO my WP
≤4.5.5Update to 4.5.5.1
- Medium5.3Unauthenticated Information Exposure
GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO
≤4.4.1Update to 4.4.2
- Medium4.3Cross-Site Request Forgery
Polls CP
≤1.0.8Update to 1.0.9
- High7.5Unauthenticated SQL Injection
JetEngine
≤3.8.10.1Update to 3.8.10.2
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Ultimate Product Catalog
≤4.4.48Update to 5.0.0
- High7.5Unauthenticated Arbitrary File Download
hb-audio-gallery-lite
≤1.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Media Library Assistant
≤3.35Update to 3.36
- High8.1Unauthenticated Local File Inclusion
dharma-booking
≤2.28.3No patch available
- High7.2Authenticated Remote Code Execution
File Manager
<8.0.4Update to 8.0.4
- High7.5Unauthenticated Arbitrary File Download
Simple Backup
≤2.7.11No patch available
- High8.1Unauthenticated Local File Inclusion
IMDB Profile Widget
≤1.0.8No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Booking Calendar Contact Form
≤1.1.24Update to 1.1.25
- High7.3Privilege Escalation to Unauthenticated Account Takeover
AllCoach – Coaching Management & Scheduling
≤1.0.1Update to 1.0.2
- Medium5.3Missing Authorization
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.12.5Update to 1.12.6
- Critical9.1Unauthenticated Arbitrary File Deletion
Workscout Core
≤1.7.11Update to 1.7.12
- High7.5Unauthenticated Backup Download
Cherry Framework
≤3.1.4No patch available
- High7.5Authenticated (Authenticated+) Local File Inclusion
FileOrganizer – WordPress File Manager
≤1.1.0Update to 1.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
- High8.8Authenticated (Subscriber+) Remote Code Execution
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤2.0.8Update to 2.0.9
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.12Update to 4.1.13