Database
WordPress Vulnerability Database (page 248)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'card_id' Parameter
Task & Project Management – Alba Board
≤2.1.3Update to 2.1.4
- High8.8Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link
Advanced Google reCAPTCHA
≤5.38Update to 5.39
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
Advanced Google reCAPTCHA
≤5.38Update to 5.39
- Critical9.8Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
Hippoo Mobile App for WooCommerce
≤1.9.4Update to 1.9.5
- Medium5.3Missing Authorization
Hybrid Composer
≤1.4.6Update to 1.4.7
- High8.8Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value
Admin Columns
≤7.0.18Update to 7.0.19
- Medium4.3Authenticated (Subscriber+) Information Exposure
Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons
≤1.4.8Update to 1.4.9
- Medium5.3Unauthenticated Private/Draft Post Disclosure
YMC Filter
≤3.11.2Update to 3.11.3
- Medium5.3Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Action
Debug Log Manager – Conveniently Monitor and Inspect Errors
≤2.5.0Update to 2.5.1
- High7.5Unauthenticated SQL Injection
JetSearch
≤3.5.17Update to 3.5.17.1
- Medium5.3Missing Authorization
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤6.7.10Update to 6.7.11
- High7.5Unauthenticated SQL Injection
Manago AI & Leadoo AI
≤3.11.2Update to 3.11.3
- High8.1Unauthenticated PHP Object Injection
Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
≤1.2.1Update to 1.2.2
- High7.5Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.17Update to 2.9.18
- High8.1Unauthenticated PHP Object Injection
Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms
≤1.1.1Update to 1.1.2
- Medium5.3Unauthenticated Arbitrary File Download
10WebAdManager
≤1.0.11No patch available
- Medium5.3Missing Authorization
User Registration Stripe
≤1.3.12Update to 1.3.13
- High8.1Unauthenticated PHP Object Injection
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
≤1.1.4Update to 1.1.5
- Medium5.3Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action
Event Monster – Event Manager, Event Booking, Event Ticket & Registration
≤2.1.0Update to 2.2.0
- Medium5.3Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤10.0.09Update to 10.0.10
- Medium5.3Unauthenticated Path Traversal
Shared Files – File Upload & Download Manager
≤1.7.64Update to 1.7.65
- High8.8Authenticated (Contributor+) Privilege Escalation
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.5.1Update to 5.5.2
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.16Update to 2.9.17
- High8.1Unauthenticated PHP Object Injection
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
≤1.1.4Update to 1.1.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Shariff for WordPress
≤1.0.11No patch available
- High7.2Authenticated (Author+) Server-Side Request Forgery
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤6.1.3Update to 6.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
WPFunnels Pro
≤2.9.4Update to 2.9.5
- Medium5.3Directory Traversal to Unauthenticated Folder Content Disclosure
Printcart Store – Web to Print Product Designer for WooCommerce
≤2.5.1Update to 2.5.2
- High8.1Unauthenticated PHP Object Injection
Moderno – Fashion & Clothing, Furniture
<1.43Update to 1.43
- High8.1Unauthenticated PHP Object Injection
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
≤1.1.6Update to 1.1.7