Database
WordPress Vulnerability Database (page 254)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
Tainacan
≤1.0.3Update to 1.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Advanced IP Blocker
≤8.10.7Update to 8.10.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Simply Schedule Appointments
≤1.6.10.6Update to 1.6.11.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤3.6.2Update to 3.6.3
- Medium5.3Missing Authorization
Smart Online Order for Clover
≤1.6.0Update to 1.6.1
- Medium5.3Missing Authorization
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤1.10.0.4Update to 1.10.0.5
- Medium5.3Two-Factor Authentication Bypass
CloudSecure WP Security
≤1.4.7Update to 1.4.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Grand Car Rental | Limousine HTML Template
≤3.7No patch available
- High7.2Authenticated (Editor+) Privilege Escalation
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.4.9Update to 3.5.0
- High8.1Unauthenticated PHP Object Injection
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.3.23Update to 7.3.24
- Medium5.3Missing Authorization
Quads Ads Manager for Google AdSense
≤3.0.2Update to 3.0.3
- Medium6.5Authenticated (Contributor+) SQL Injection
Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend
≤3.3.2Update to 3.3.3
- Critical9.8Unauthenticated Arbitrary File Upload
MagicForm
≤0.1.3No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
Views for WPForms – Display & Edit WPForms Entries on your site frontend
≤3.4.6Update to 3.4.7
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
Shariff Wrapper
≤4.6.20Update to 4.6.21
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint
Simply Schedule Appointments
≤1.6.11.8Update to 1.6.11.9
- Medium6.5Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.40Update to 1.8.41
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.11.14Update to 3.11.15
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Action
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
≤1.42.0Update to 1.42.1
- Medium4.3Authenticated (Contributor+) Information Exposure via Block Editor Page
PDF Embedder – PDF Viewer & Embed PDF Files for WordPress
≤4.9.3Update to 5.0.0
- Critical9.1Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters
GEO my WP
≤4.5.4Update to 4.5.5
- Medium4.3Cross-Site Request Forgery to Stripe Unlink
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
≤1.120.46Update to 1.120.47
- High7.5Unauthenticated SQL Injection via 'append_where_sql' Parameter
Simply Schedule Appointments
≤1.6.11.8Update to 1.6.11.9
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.4.11Update to 5.4.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Video Element
a3 Lazy Load
≤2.7.6Update to 2.7.7
- Medium6.1Reflected Cross-Site Scripting via 'paged' Parameter
Easy Updates Manager
≤9.0.20Update to 9.0.21
- High7.2Unauthenticated Stored Cross-Site Scripting via File Upload Field
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.8.2Update to 2.8.3
- High8.1Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter
WP Contact Form 7 DB Handler
≤3.0Update to 3.1
- Medium5.3Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter
Geo Mashup
≤1.13.19Update to 1.13.20
- High8.8Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter
GutenBee – Gutenberg Blocks
≤2.20.1Update to 2.20.2