Database
WordPress Vulnerability Database (page 252)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.6Update to 4.3.7
- High7.2Unauthenticated Stored Cross-Site Scripting
VikBooking Hotel Booking Engine & PMS
≤1.8.9Update to 1.8.10
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Google Review Slider
≤18.0Update to 18.1
- High7.5Unauthenticated SQL Injection
Active Woot Products Tables for WooCommerce. 100% FREE
≤1.0.9Update to 1.1.0
- Critical9.1Unauthenticated Arbitrary File Deletion
Gravity Forms
≤2.10.0.1Update to 2.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Filter Widget for Elementor
≤1.0.6No patch available
- Medium5.3Missing Authorization
WPC Product Bundles for WooCommerce
≤8.5.3Update to 8.5.4
- Medium5.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.1.7Update to 2.1.8
- High7.2Unauthenticated Stored Cross-Site Scripting
cformsII
≤15.1.3Update to 15.1.4
- High7.2Authenticated (Outlet Manager+) Privilege Escalation
Vitepos – Point of Sale (POS) for WooCommerce
<3.4.2Update to 3.4.2
- Medium5.3Unauthenticated Information Exposure
EmbedPress
≤4.5.2Update to 4.5.3
- Medium5.3Missing Authorization
Booknetic
≤4.8.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Stop Spammers Classic
≤2026.3Update to 2026.4
- Critical9.8Unauthenticated Privilege Escalation
AI Copilot – Content Generator
≤1.4.17Update to 1.4.19
- Critical9.8Unauthenticated Remote Code Execution
Easy Invoice – Invoice Generator, PDF Quotes & Payments
≤2.1.19Update to 2.1.20
- Medium4.3Missing Authorization
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤8.4.1Update to 8.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.6Update to 14.16.7
- Medium6.1Responsive Multi-Purpose Theme <= 7.1.4 - Reflected Cross-Site Scripting
enfold
≤7.1.4Update to 7.1.5
- High8.1Unauthenticated PHP Object Injection
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<5.4.0Update to 5.4.0
- Critical9.8Unauthenticated Privilege Escalation
Support Board
<3.8.9Update to 3.8.9
- Medium5.3Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters
Advanced Custom Fields (ACF®)
≤6.8.1Update to 6.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliate Super Assistent
≤1.10.1Update to 1.10.2
- Critical9.8Unauthenticated Privilege Escalation
WebinarIgnition – AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside
<4.08.253Update to 4.08.253
- High7.5Unauthenticated SQL Injection
TableOn – WordPress Posts Table Filterable
≤1.0.5.1Update to 1.0.6
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
WebinarIgnition – AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside
<4.08.253Update to 4.08.253
- Medium5.3Missing Authorization
Backup and Staging by WP Time Capsule
≤1.22.25Update to 1.22.26
- High7.2Unauthenticated Stored Cross-Site Scripting
Favicon by RealFaviconGenerator
≤1.3.46Update to 1.3.47
- High7.5Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters
GEO my WP
≤4.5.5Update to 4.5.5.1
- High7.5Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint
Simple History – Track, Log, and Audit WordPress Changes
≤5.26.0Update to 5.27.0
- High8.8Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
Spectra Legacy – Gutenberg Blocks
≤2.19.25Update to 2.19.26