Database
WordPress Vulnerability Database (page 246)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter
Enable Media Replace
≤4.1.8Update to 4.1.9
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Text
FV Flowplayer Video Player
≤7.5.49.7212Update to 7.5.50.7212
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field
Accordions
≤2.3.23Update to 2.3.25
- Medium6.5Authenticated (Subscriber+) SQL Injection
Booking (Reservation & Appointment)
≤3.0.3Update to 3.0.4
- High8.8Authenticated (Subscriber+) Privilege Escalation
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.2.0Update to 2.2.1
- Medium5.3Missing Authorization
WooCommerce Anti-Fraud
≤7.2.6Update to 7.2.7
- Medium5.3Missing Authorization
Hippoo Mobile App for WooCommerce
≤1.9.5Update to 1.9.6
- Medium5.3Missing Authorization
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
≤9.4.0.0Update to 9.4.0.1
- High7.5Unauthenticated SQL Injection
JetEngine
<3.8.9.1Update to 3.8.9.1
- Medium5.3Unauthenticated Information Exposure
Affiliates Manager
≤2.9.50Update to 2.9.51
- Medium4.3Missing Authorization
Faust.js
≤1.8.7Update to 1.8.8
- High7.5Unauthenticated SQL Injection
Advanced 301 and 302 Redirect
≤1.6.9Update to 1.7.0
- High7.2Unauthenticated Stored Cross-Site Scripting
APCu Manager
≤4.4.0Update to 4.5.0
- Medium5.3Unauthenticated Information Exposure
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.49Update to 2.8.50
- High7.5Unauthenticated SQL Injection
The Events Calendar
6.15.12 – 6.16.2Update to 6.16.3
- Medium5.3Missing Authorization
WooCommerce Dropshipping Premium
≤5.2.4Update to 5.2.5
- High7.5Authenticated (Contributor+) PHP Object Injection
JetEngine
≤3.8.9.1Update to 3.8.10
- High7.5Unauthenticated SQL Injection
wpDataTables (Premium)
≤7.3.6Update to 7.4
- Critical9.8Unauthenticated Privilege Escalation
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤5.5.0Update to 5.6.0
- Medium5.3Unauthenticated Information Exposure
Conekta Payment Gateway
≤6.0.0Update to 6.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.9.1Update to 3.8.10
- High7.2Unauthenticated Stored Cross-Site Scripting
WPZOOM Portfolio Lite – Filterable Portfolio Plugin
≤1.4.21Update to 1.4.22
- Critical9.8Unauthenticated Privilege Escalation
LoginPress Pro
≤6.2.2Update to 6.2.3
- High7.5Unauthenticated SQL Injection
JetEngine
≤3.8.9.1Update to 3.8.10
- High7.5Unauthenticated Arbitrary File Download
WPC Product Options for WooCommerce
≤3.2.1Update to 3.2.2
- Critical9.8Unauthenticated Remote Code Execution
Background Image Cropper
≤1.2No patch available
- Medium4.9Authenticated (Admin+) Stored Cross-Site Scripting
Accept Stripe Payments
≤2.0.39Update to 2.0.40
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes'
Recipe Card Blocks Lite
≤3.4.13Update to 3.4.14
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.16.16Update to 4.16.17
- High7.2Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action
Booking Package
≤1.7.16Update to 1.7.17