Database
WordPress Vulnerability Database (page 266)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Local File Inclusion
WP with Spritz
≤1.0No patch available
- Medium4.3Authenticated (Subscriber+) Arbitrary File Download
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.3.8Update to 5.3.9
- Critical9.8Unauthenticated Privilege Escalation
Contest Gallery Pro
≤29.0.1Update to 29.0.2
- High8.8Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
3.4.9 – 3.4.9Update to 3.5.0
- High8.1Unauthenticated Local File Inclusion
Backup by Supsystic
≤2.3.9No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.14.5Update to 4.14.6
- High7.1Authenticated (Subscriber+) Arbitrary File Deletion
Backup and Restore plugin – WordPress
≤1.0.3No patch available
- High7.2Authenticated (Admin+) Arbitrary File Upload
Helios Solutions Brand Logo Slider
≤2.1No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Wibar | Wine and Vineyard WooCommerce WordPress Theme
≤1.1.8No patch available
- High7.5Unauthenticated SQL Injection
Membership by Supsystic
≤1.4.7No patch available
- Medium5.3Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter
Essential Chat Support
≤1.0.1No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Collaboration Comment
Multicollab: Content Team Collaboration and Editorial Workflow
≤5.2Update to 5.3
- Medium5.3Missing Authorization
Smart Coupons For WooCommerce Coupons
<2.3.0Update to 2.3.0
- Medium5.3Missing Authorization
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.1.41Update to 1.1.42
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤3.0.4Update to 3.0.5
- High8.8Unauthenticated Arbitrary File Upload
WP Super Edit
≤2.5.4No patch available
- Medium5.3Missing Authorization
WP Document Revisions
≤3.8.1Update to 4.0.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.3.10Update to 5.4.0
- High8.8Unauthenticated Privilege Escalation via Edit User Form
ACF Frontend Admin by DynamiApps
≤3.28.36Update to 3.29.1
- High7.5Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter
Quick Playground
≤1.3.3Update to 1.3.4
- Critical9.8Unauthenticated Authentication Bypass via LINE OAuth Callback
Receive Notifications After Form Submitting – Form Notify for Any Forms
≤1.1.10Update to 1.1.11
- Medium4.3Cross-Site Request Forgery to Settings Update
Notify Odoo
≤1.0.1Update to 1.0.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'table' Parameter
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.1.12Update to 9.1.13
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter
The7 — Website and eCommerce Builder for WordPress
≤14.3.2Update to 14.3.3
- Medium5.3Missing Authorization
Access Governance for WordPress (aka AAM)
≤7.1.0Update to 7.1.1
- Medium4.3Cross-Site Request Forgery
Simple Membership MailChimp Integration
≤1.9.7Update to 1.9.8
- Medium5.3Unauthenticated Information Exposure
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity
≤3.3.6Update to 3.3.7
- Medium6.5Missing Authorization to Unauthenticated Plugin Settings Update
Smartcat Translator for WPML
≤3.1.77Update to 3.1.78
- High8.1Missing Authorization to Authenticated (Contributor+) Configuration Deletion
FOX – Currency Switcher Professional for WooCommerce
≤1.4.5Update to 1.4.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field
Advanced Custom Fields: Font Awesome Field
≤5.0.2Update to 6.0.0