Database
WordPress Vulnerability Database (page 247)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.41Update to 1.8.42
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.4Update to 4.9.5
- Medium5.3Unauthenticated Insecure Direct Object Reference via REST API Endpoints
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.96.6Update to 2.97.1
- Medium4.3Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations
GEO Plugin by Squirrly SEO
≤12.4.16Update to 12.4.17
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter
Klamra Paycal for Aspaclaria
≤1.1.4Update to 1.1.5
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export
Smart Slider 3
≤3.5.1.36Update to 3.5.1.37
- Medium5.3Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.6.4Update to 6.6.5
- Medium5.3Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.6Update to 4.3.7
- Medium4.4Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter
Quick Playground
≤1.3.4Update to 1.3.5
- High7.2Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter
MDJM Event Management
≤1.7.8.3Update to 1.7.8.4
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter
LearnPress – Backup & Migration Tool
≤4.1.4Update to 4.1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute
EmbedPress
≤4.5.3Update to 4.5.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.9.7Update to 1.3.9.8
- Medium6.1Reflected Cross-Site Scripting via URL Parameters in iframe Mode
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.15Update to 2.8.16
- Medium5.3Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤1.10.0.4Update to 1.10.0.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'order_by' Parameter
OptinCraft – Drag & Drop Optins & Popup Builder for WordPress
≤1.2.0Update to 1.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter
Click to Chat – HoliThemes
≤4.39Update to 4.40
- Medium6.6Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload
LearnPress – Backup & Migration Tool
≤4.1.4Update to 4.1.5
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes
Page-list
≤6.2Update to 6.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Submission Data
Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More
≤1.0.15Update to 1.0.16
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.1.0Update to 3.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting via REST API Request Path
All-In-One Security (AIOS) – Security and Firewall
≤5.4.7Update to 5.4.8
- Medium4.3Cross-Site Request Forgery via invoices__change_status Action
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.0Update to 5.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Simple SEO Slideshow
≤1.2.8Update to 1.2.9
- Medium4.3Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.1.7Update to 5.1.8
- Medium4.9Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.1.2Update to 11.1.3
- Low3.8Authenticated (Admin+) Arbitrary Directory Deletion
WPvivid — Backup, Migration & Staging
≤0.9.128Update to 0.9.129
- Medium4.3Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action
Frontend User Notes
≤2.1.1Update to 2.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Express Payment For Stripe
≤1.28.0Update to 1.28.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.11.1Update to 1.8.11.2