Database
WordPress Vulnerability Database (page 242)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.11.0Update to 2.12.0
- Medium5.4Cross-Site Request Forgery to Cross-Site Scripting
Polls CP
≤1.0.8Update to 1.0.9
- High7.5Authenticated (Contributor+) PHP Object Injection
Avada | Website Builder For WordPress & WooCommerce
≤3.15.3Update to 3.15.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Pods – Custom Content Types and Fields
≤3.3.8Update to 3.3.9
- Medium5.3Missing Authorization
WCPOS – Point of Sale (POS) plugin for WooCommerce
≤1.8.14Update to 1.9.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Avada (Fusion) Builder
≤3.15.4Update to 3.15.5
- Medium5.3Missing Authorization
GEO Plugin by Squirrly SEO
≤12.4.16Update to 12.4.17
- Medium6.5Authenticated (Contributor+) SQL Injection
Sliced Invoices – WordPress Invoice Plugin
≤3.8.2Update to 3.8.3
- High7.5Unauthenticated SQL Injection
404 SEO Redirection
≤1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Membership
≤4.7.4Update to 4.7.5
- Critical9.8Unauthenticated Arbitrary File Upload
SigmaForms Pro – AI Generated Forms
≤1.4.5Update to 1.4.6
- High8.1Unauthenticated Local File Inclusion
WANotifier for Forms and Actions
≤2.5Update to 2.6
- Medium4.3Cross-Site Request Forgery
Lazy content Slider
≤3.4No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Attendance Manager
≤0.6.2Update to 0.6.3
- High8.1Unauthenticated Local File Inclusion
Brandfolder – Digital Asset Management Simplified.
≤3.0No patch available
- Medium4.3Cross-Site Request Forgery
more-fields
≤2.1No patch available
- High8.1Unauthenticated Local File Inclusion
photocart-link
≤1.6No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
Online Scheduling and Appointment Booking System – Bookly
≤27.2Update to 27.3
- Medium4.3Missing Authorization to Authenticated (Author+) Shortcode creation
Meow Gallery
≤5.4.4Update to 5.4.5
- Medium4.3Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
Page Builder: Pagelayer – Drag and Drop website builder
≤2.0.9Update to 2.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
Page Builder: Pagelayer – Drag and Drop website builder
≤2.0.9Update to 2.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute
Canvas
≤2.5.2Update to 2.5.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤3.1.31Update to 3.1.32
- High7.2Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
≤2.31Update to 2.32
- High7.5Unauthenticated SQL Injection via WordPress Search 's' Parameter
Customer Support Ticket System & Helpdesk
≤6.0.4Update to 6.0.5
- Medium4.9Authenticated (Editor+) Arbitrary File Read
LWS Optimize – All-in-One Speed Booster & Cache Tools
≤3.3.19Update to 3.3.20
- High8.1Unauthenticated Local File Inclusion
Kastell - WordPress Theme for Single Properties and Apartments
≤2.0Update to 2.0.1
- Medium5.3Two Factor Authentication Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.5.10.0Update to 9.5.10.1
- Medium5.3Unauthenticated Path Traversal
FastDup – Fastest WordPress Migration & Duplicator
≤2.7.2Update to 2.7.3
- High8.1Unauthenticated PHP Object Injection
JetEngine
≤3.8.10Update to 3.8.10.1