Database
WordPress Vulnerability Database (page 244)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
PT Luxa Addons
≤1.2.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20260607Update to 20260608
- Medium5.3Two-Factor Authentication Bypass
WebAuthn Provider for Two Factor
≤2.5.5Update to 2.5.6
- Medium5.3Unauthenticated Private/Draft Product Data Disclosure
MKL Product Configurator for WooCommerce – 2D & 3D Live Preview
≤1.7.2Update to 1.7.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤5.0.7Update to 5.0.8
- Medium4.3Authenticated (Subscriber+) Information Exposure
PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget
≤4.2.3Update to 4.2.4
- Medium5.3Unauthenticated Information Exposure
Digital Signature Add-on for WooCommerce
≤2.0Update to 2.0.1
- Medium5.3Unauthenticated Information Exposure
JetBlog
≤2.4.8Update to 2.4.8.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce
≤3.0.2Update to 3.0.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
VikRentCar Car Rental Management System
≤1.4.5Update to 1.4.6
- Medium5.3Missing Authorization to Unauthenticated MCP Tool Use
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP
≤1.4.25Update to 1.4.26
- Medium5.3Unauthenticated Information Exposure
ABC Crypto Checkout
≤1.8.2Update to 1.8.3
- Critical9.8Unauthenticated Privilege Escalation
Doctreat Core
≤1.6.8Update to 1.7.0
- High7.5Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
Newsletters
≤4.13Update to 4.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting
aThemes Addons for Elementor – Widgets & Elementor Addons
≤1.1.8Update to 1.1.9
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter
MW WP Form
≤5.1.3Update to 5.1.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters
Easy Image Collage
≤1.13.6Update to 2.0.0
- High7.5Unauthenticated SQL Injection
simply-poll
≤1.4.1No patch available
- Medium4.3Authenticated (Subscriber+) Information Exposure
Coupon Affiliates – Affiliate Plugin for WooCommerce
≤7.8.1Update to 7.8.2
- High7.5Unauthenticated Arbitrary File Download
apptha-slider-gallery
≤1.0No patch available
- High8.2Unauthenticated SQL Injection
Car Park Booking System for WordPress
≤1.0No patch available
- High7.5Unauthenticated SQL Injection
kittycatfish
≤2.2No patch available
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference
BuddyPress
≤14.4.0No patch available
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference
BuddyPress
≤14.4.0No patch available
- High7.5Unauthenticated Arbitrary File Deletion
Mac Photo Gallery
≤3.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Support Plus Responsive Ticket System
≤9.1.2No patch available
- High7.5Unauthenticated SQL Injection
mwp-viral-signup
≤2.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.12Update to 2.4.13
- Medium4.3Authenticated (Calendar Manager+) Information Exposure
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.1.1Update to 2.1.2
- High7.5Unauthenticated SQL Injection
eCommerce Product Catalog
≤3.5.5Update to 3.5.6