Database
WordPress Vulnerability Database (page 267)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
WP Directory Kit
≤1.5.1Update to 1.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1058Update to 1.7.1059
- Medium5.3Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.5Update to 5.1.6
- High7.5Unauthenticated Arbitrary File Read via 'url' Parameter
InfusedWoo Pro
≤5.1.2Update to 5.1.3
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter
MW WP Form
≤5.1.2Update to 5.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter
CC Child Pages
≤2.1.1Update to 2.1.2
- Critical9.1Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters
InfusedWoo Pro
≤5.1.2Update to 5.1.3
- Medium6.5Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤5.0.6Update to 5.0.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode
Bold Page Builder
≤5.6.8Update to 5.6.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute
Meta Field Block – Display Custom Fields for ACF, Meta Box and More
≤1.5.2Update to 1.5.3
- Medium6.5Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters
Media Sync
≤1.4.9Update to 1.5.0
- High8.8Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update
InfusedWoo Pro
≤5.1.2Update to 5.1.3
- Critical9.8Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'
InfusedWoo Pro
≤5.1.2Update to 5.1.3
- High8.2Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.0Update to 6.2.1
- Medium6.5Authenticated (Author+) Limited Privilege Escalation via register_user
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.5.13Update to 6.6.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header
ManageWP Worker
≤4.9.31Update to 4.9.32
- Critical9.8Unauthenticated Arbitrary File Upload
Career Section
≤1.7Update to 1.8
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
Motors – Car Dealership & Classified Listings Plugin
≤1.4.107Update to 1.4.108
- Medium4.3Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.3.2Update to 5.4.0
- Medium6.1Reflected Cross-Site Scripting via 'failed_orders'
GLS Shipping for WooCommerce
≤1.4.0Update to 1.4.1
- Medium6.1Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter
MapGeo – Interactive Geo Maps
≤1.6.27Update to 1.6.28
- Medium5.4One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering
WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect
≤7.8.5.10Update to 7.8.5.11
- High8.2Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.1.21Update to 6.2.0
- Critical9.83.4.1.1 - Authentication Bypass to Admin Account Takeover
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
3.4.0 – 3.4.1.1Update to 3.4.2
- Medium4.3Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.5Update to 4.3.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.12.4Update to 1.12.5
- Medium6.5Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter
Unlimited Elements for Elementor
≤2.0.7Update to 2.0.8
- High7.5Unauthenticated Omnisend Account Takeover via Predictable Connect Token
Email Marketing for WooCommerce by Omnisend
≤1.18.0Update to 1.18.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.4.11Update to 6.4.12
- High7.5Missing Authorization to Unauthenticated Database Backup Interception
Database Backup for WordPress
≤2.5.2Update to 2.5.3