Database
WordPress Vulnerability Database (page 263)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter
Alfie – Feed Plugin
≤1.2.1No patch available
- Medium6.1Reflected Cross-Site Scripting via 'shortcode' Parameter
WP Blockade – Visual Page Builder
≤0.9.14No patch available
- High8.8Unauthenticated Privilege Escalation via 'custom_meta' Parameter
Easy Elements for Elementor – Addons & Website Templates
≤1.4.9Update to 1.5.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation
FastX
≤1.0.2No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title
Draft List
2.6.3 – 2.6.3Update to 2.6.4
- Medium6.1Reflected Cross-Site Scripting via 'page' Parameter
CBX 5 Star Rating & Review
≤1.0.7Update to 1.0.8
- Medium6.4[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
KIA Subtitle
≤4.0.1Update to 4.0.2
- Medium4.3Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging
Location Weather – WordPress Weather Forecast, Air Quality & Weather Widget
≤3.0.2Update to 3.0.3
- High7.5Unauthenticated SQL Injection via 'search_key' Parameter
WP ERP Pro
≤1.5.1No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset
GSheet For Woo Importer
≤2.3.1Update to 2.4.1
- Critical9.8Unauthenticated Arbitrary File Upload via Signature Custom Field
BookingPress Appointment Booking Pro
≤5.6Update to 5.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.4.11Update to 6.4.12
- Medium5.3Missing Authorization
WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms
≤1.7.6Update to 1.8.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.4.11Update to 6.4.12
- Medium4.3Authenticated (Subscriber+) Information Exposure
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.19.5Update to 1.20.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes
Avada (Fusion) Builder
≤3.15.2Update to 3.15.3
- Critical9.8Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
Avada (Fusion) Builder
≤3.15.2Update to 3.15.3
- Medium4.9Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category Field
WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons
≤1.0.8Update to 1.0.9
- Medium4.3Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta
Broadstreet
≤1.52.2Update to 1.53.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Draft List
<2.6.4Update to 2.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Code Embed
≤2.6Update to 2.6.1
- High7.2Unauthenticated Stored Cross-Site Scripting
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.8.2Update to 2.8.3
- Medium6.5Authenticated (Contributor+) SQL Injection
PowerPress Podcasting plugin by Blubrry
≤11.15.10Update to 11.15.11
- High7.2Unauthenticated Stored Cross-Site Scripting
VikBooking Hotel Booking Engine & PMS
≤1.8.8Update to 1.8.9
- Critical9.8Unauthenticated Arbitrary File Upload
Gift Cards For WooCommerce Pro
≤4.2.6Update to 4.2.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Visualizer – Tables & Charts Manager with Built-in AI Generator
<4.0.0Update to 4.0.0
- Medium4.9Authenticated (Admin+) SQL Injection
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<4.2.1Update to 4.2.1
- Medium4.3Missing Authorization
PDF for Elementor Forms + Drag And Drop Template Builder
≤5.5.1Update to 5.6.1
- Critical9.8Unauthenticated Privilege Escalation via 'role'
Divi Form Builder
≤5.1.2Update to 5.1.3
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
QuickWebP – WebP & AVIF Image Optimizer, Compression & SEO for WordPress
≤3.2.7Update to 3.2.8