Database
WordPress Vulnerability Database (page 250)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Instructor+) SQL Injection via 'columns' Parameter
MasterStudy LMS Pro
≤4.8.20Update to 4.8.21
- Medium6.5Authenticated (Subscriber+) SQL Injection
Geo Mashup
≤1.13.19Update to 1.13.20
- Medium4.3Authenticated (Subscriber+) Information Exposure
Backup, Restore and Migrate your sites with XCloner
≤4.8.6Update to 4.8.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.1.2Update to 11.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.15.0.2Update to 3.15.0.3
- Medium5.3Unauthenticated Information Exposure
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
≤4.9.4Update to 4.9.5
- Medium4.3Missing Authorization
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.271Update to 1.0.271.1
- High8.8Authenticated (Customer+) Privilege Escalation
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.0.2Update to 5.0.3
- Medium5.3Missing Authorization
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.5.10Update to 9.5.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤5.7.2Update to 5.7.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.9.7Update to 1.3.9.8
- Medium4.3Missing Authorization
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.5.9Update to 9.5.10
- Medium5.3Missing Authorization
JobSearch WP Job Board
≤3.2.7Update to 3.2.8
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
EmergencyWP – Dead Man's switch & legacy deliverance
≤1.4.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting
Passeum Ticketing
≤1.0No patch available
- Critical9.8Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤7.3.1Update to 7.3.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤7.3.1Update to 7.3.2
- High7.5Unauthenticated SQL Injection via 'order' Parameter
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤7.3.1Update to 7.3.2
- High8.8Authenticated (Contributor+) Remote Code Execution
Content Visibility for Divi Builder
≤4.02Update to 5.00
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.62Update to 51.1.63
- Medium5.3Missing Authorization
JS Help Desk – AI-Powered Support & Ticketing System
≤3.0.9Update to 3.1.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.2Update to 2.5.3
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Progress Planner
≤1.9.0Update to 1.9.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Time Slots Booking Form
≤1.2.50Update to 1.2.51
- High7.5Unauthenticated SQL Injection
JS Help Desk – AI-Powered Support & Ticketing System
≤3.0.9Update to 3.1.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
ELEX WordPress HelpDesk & Customer Ticketing System
≤3.3.6Update to 3.3.7
- Medium4.3Missing Authorization
Elementor Website Builder – more than just a page builder
≤4.1.0Update to 4.1.1
- Medium4.3Authenticated (Contributor+) Server-Side Template Injection to Information Exposure
DataPress (Dataverse Integration)
≤2.90Update to 2.91
- Medium4.3Authenticated (Subscriber+) Information Exposure
Visual Link Preview
≤2.4.1Update to 2.4.2
- Medium5.3Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
≤1.1.9Update to 1.2.0