Database
WordPress Vulnerability Database (page 249)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.8.6Update to 6.0.8.7
- High8.1Unauthenticated PHP Object Injection
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
≤1.26.13Update to 1.26.14
- High8.1Unauthenticated PHP Object Injection
Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms
≤1.3.7Update to 1.3.8
- Medium5.3Missing Authorization
wpForo Forum
≤3.1.0Update to 3.1.1
- Medium6.5Authenticated (Contributor+) SQL Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.41Update to 1.8.42
- High8.1Unauthenticated PHP Object Injection
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
≤1.4.3Update to 1.4.4
- High8.1Unauthenticated PHP Object Injection
OttoKit: All-in-One Automation Platform
≤1.1.27Update to 1.1.28
- Medium5.3Missing Authorization
Welcart e-Commerce
≤2.11.28Update to 2.11.29
- High8.1Unauthenticated PHP Object Injection
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
≤1.1.8Update to 1.1.9
- Medium5.3Missing Authorization to Unauthenticated WooCommerce Order Parcel-Locker Hijacking
InPost PL
≤1.9.0Update to 1.9.1
- Medium5.3Missing Authorization
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.
≤3.1.4Update to 3.1.5
- Critical9.1Unauthenticated Arbitrary File Download
Media folder Addon
≤4.0.1Update to 4.0.2
- High7.5Unauthenticated SQL Injection
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
≤2.32.6Update to 2.32.7
- Medium5.3Missing Authorization to Unauthenticated Course Progress Disclosure and Deletion
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.2.0Update to 2.2.1
- High8.8Authenticated (Subscriber+) Arbitrary Code Execution
Cornerstone
<7.8.8Update to 7.8.8
- Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion
Frontend File Manager Plugin
≤23.6No patch available
- High7.5Unauthenticated SQL Injection
WP Google Review Slider
≤6.1Update to 6.2
- High8.8Authenticated (Contributor+) Remote Code Execution
Content Visibility for Divi Builder
≤4.02Update to 5.00
- Medium5.3Unauthenticated Information Exposure
Easy PayPal Events & Tickets
≤1.3Update to 1.4
- High8.1Unauthenticated PHP Object Injection
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤6.7.12Update to 6.8.0
- High8.1Unauthenticated PHP Object Injection
wpForo Forum
≤3.1.0Update to 3.1.1
- High8.1Unauthenticated PHP Object Injection
Thrive Apprentice
<10.8.10.2Update to 10.8.10.2
- Medium5.3Unauthenticated Information Exposure
Wp EMember
≤v10.2.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Email Address Encoder
<1.0.25Update to 1.0.25
- High7.2Unauthenticated Stored Cross-Site Scripting
Live Chat Unlimited
≤2.8.3No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
FV Flowplayer Video Player
<7.5.51.7212Update to 7.5.51.7212
- High8.8Authenticated (Contributor+) Remote Code Execution
RD Station
≤5.6.0Update to 5.7.0
- Critical9.8Backdoored Software
Smart Post Show Pro
<4.0.2Update to 4.0.2
- High8.8Authenticated (Author+) Remote Code Execution
Yoast SEO Premium
≤27.6.0Update to 27.6.1
- High7.5Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function
SP Project & Document Manager
≤4.71No patch available