Database
WordPress Vulnerability Database (page 262)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.3.2.1Update to 4.3.2.2
- Medium4.3Cross-Site Request Forgery
cformsII
≤15.1.3Update to 15.1.4
- Medium4.3Cross-Site Request Forgery
Organization chart
≤1.7.5Update to 1.7.6
- Medium5.3Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.6.3Update to 7.6.4
- Medium4.3Missing Authorization
QR Redirector
≤2.0.3Update to 2.0.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.3.2.1Update to 4.3.2.2
- Medium5.3Unauthenticated Race Condition to File Overwrite
Iptanus File Upload
≤5.1.6Update to 5.1.7
- Medium6.5Authenticated (Subscriber+) SQL Injection
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.29Update to 3.7.30
- Critical9.8Unauthenticated Privilege Escalation
miniOrange OTP Login, Verification and SMS Notifications
≤5.4.9Update to 5.5.0
- Medium5.3Missing Authorization
Quads Ads Manager for Google AdSense
≤3.0.2Update to 3.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.1Update to 2.5.2
- Medium4.9Authenticated (Admin+) Arbitrary File Read
Agile Store Locator
≤1.6.8Update to 1.6.9
- High7.5Unauthenticated SQL Injection
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.1Update to 2.5.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Agile Store Locator
≤1.6.8Update to 1.6.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Property Hive
≤2.2.2Update to 2.2.3
- High8.8Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action
Wishlist Member
≤3.30.1Update to 3.31.0
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action
Wishlist Member
≤3.32.0Update to 3.32.1
- High8.8Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action
Wishlist Member
≤3.30.1Update to 3.31.0
- High8.8Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action
Wishlist Member
≤3.30.1Update to 3.31.0
- High8.2Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure
WooCommerce PayPal Payments
≤4.0.1Update to 4.0.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Secure Copy Content Protection and Content Locking
≤5.1.4Update to 5.1.5
- Medium6.4Dashboard Notes <= 0.8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
KeepInMind Dashboard Notes
≤0.8.4.1Update to 0.8.4.2
- High7.5Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter
AudioIgniter Music Player
≤2.0.2Update to 2.0.3
- Medium4.3Cross-Site Request Forgery to Settings Update via 'wl' Parameter
Widget Context
≤1.3.3Update to 1.4.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action
Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder
≤1.1.1Update to 1.2.0
- Medium4.3Authenticated (Subscriber+) Information Disclosure via REST API Endpoint
Slider by Soliloquy – Responsive Image Slider for WordPress
≤2.8.1Update to 2.8.2
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action
MotoPress Hotel Booking
≤6.0.1Update to 6.0.2
- Medium5.4Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
≤2.9.87Update to 3.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.4.11Update to 6.4.12
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.65Update to 3.1.66