Database
WordPress Vulnerability Database (page 253)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.18Update to 2.1.19
- Medium5.3Unauthenticated Payment Bypass
Accept Stripe Payments
≤2.0.98Update to 2.0.99
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WPComplete
≤2.9.5.4Update to 2.9.5.5
- Low3.1Missing Authorization
Disable Comments & Delete All Comments
≤1.3.0Update to 1.3.1
- Medium5.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.11.10Update to 2.11.11
- High8.8Authenticated (Contributor+) Arbitrary File Upload
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce
≤5.4.1Update to 5.4.2
- Medium5.3Missing Authorization to Unauthenticated Homepage Settings Modification
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.271Update to 1.0.271.1
- Medium5.3Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)
Contact Form 7 – PayPal & Stripe Add-on
≤2.4.9Update to 2.4.10
- Medium4.9Authenticated (Administrator+) SQL Injection via 'order' Parameter
ACF Frontend Admin by DynamiApps
≤3.28.8Update to 3.28.29
- High8.1Cross-Site Request Forgery via Bulk Action Form
Media Library Assistant
≤3.35Update to 3.36
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.4.15Update to 6.4.16
- High7.2Unauthenticated Stored Cross-Site Scripting
Link Whisper Free
≤0.9.0Update to 0.9.1
- Critical9.8Unauthenticated Authentication Bypass via Firebase OTP Verification
OTP Login With Phone Number, OTP Verification
1.8.50 – 1.8.60Update to 1.8.61
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details
Automotive Car Dealership Business WordPress Theme
≤13.4.1Update to 13.4.2
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname
StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps
≤2.1.1Update to 2.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Simple Divi Shortcode
≤1.2Update to 1.2.1
- Critical9.8Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action
WP Maps Pro
≤6.1.0Update to 6.1.1
- High8.8Authenticated (Subscriber+) PHP Object Injection
WooCommerce Infinite Scroll and Ajax Pagination
≤1.8No patch available
- Medium5.3Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie
Breeze Cache
≤2.5.2Update to 2.5.3
- Critical9.1Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators
WP Travel Pro
≤11.1.0Update to 11.2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Import
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.0.19Update to 4.1.1
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
≤6.3.7Update to 6.3.8
- Critical9.8Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
Advanced Custom Fields: Extended
≤0.9.2.5Update to 0.9.2.6
- High7.5Unauthenticated SQL Injection
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder
≤4.0.6Update to 4.0.7
- Critical9.8Unauthenticated Privilege Escalation
Support Ticket Management System for WordPress
≤1.9No patch available
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.2Update to 5.1.3
- Medium5.3Missing Authorization
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.1.8Update to 2.1.9
- High8.1Unauthenticated PHP Object Injection
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<7.1.3Update to 7.1.3
- Medium5.3Unauthenticated Sensitive Information Exposure
Smart Online Order for Clover
≤1.6.0Update to 1.6.1
- High7.5Unauthenticated SQL Injection
GEO my WP
≤4.5.4Update to 4.5.5