Database
WordPress Vulnerability Database (page 268)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Missing Authorization to Unauthenticated Arbitrary File Read and Deletion
Database Backup for WordPress
≤2.5.2Update to 2.5.3
- Medium4.3Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
My Calendar – Accessible Event Manager
≤3.7.9Update to 3.7.10
- High7.2Unauthenticated Stored Cross-Site Scripting
Redirection for Contact Form 7
≤3.2.8Update to 3.2.9
- Medium4.3Missing Authorization
WPBakery Page Builder
≤8.7.2Update to 8.7.3
- Medium5.3Missing Authorization
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.157Update to 2.8.158
- High7.5Missing Authorization to Unauthenticated Database Export
Database Backup for WordPress
≤2.5.2Update to 2.5.3
- High7.5Unauthenticated SQL Injection via 'product_order' Parameter
Avada (Fusion) Builder
≤3.15.1Update to 3.15.2
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
Avada (Fusion) Builder
≤3.15.2Update to 3.15.3
- Medium5.3Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
Tutor LMS – eLearning and online course solution
≤3.9.9Update to 3.9.10
- High7.5Unauthenticated SQL Injection via 'sortf' Parameter
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.7.7Update to 5.7.8
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Exposure
ilGhera Support System for WooCommerce
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Cost of Goods: Product Cost & Profit Calculator for WooCommerce
≤4.1.0Update to 4.1.1
- Medium6.5Authenticated (Custom+) SQL Injection via 's' Search Parameter
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.10.4Update to 1.8.10.5
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Advertiser Creation
Broadstreet
≤1.53.1Update to 1.53.2
- Medium5.3Authenticated (Subscriber+) Information Disclosure
Broadstreet
≤1.53.1Update to 1.53.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Broadstreet
≤1.53.1Update to 1.53.2
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter
Blog2Social: Social Media Auto Post & Scheduler
≤8.9.0Update to 8.9.1
- Medium5.3Unauthenticated Price Manipulation and Insecure Direct Object Reference
Cost Calculator Builder
≤4.0.1Update to 4.0.2
- High7.5Unauthenticated SQL Injection
Court Reservation – Tennis, Padel & Sports Court Booking
≤1.10.11Update to 1.10.12
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Advanced Custom Fields: Extended
≤0.9.2.3Update to 0.9.2.4
- High7.1Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤10.1.2Update to 10.1.3
- High8.8Authenticated (Contributor+) Privilege Escalation
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)
≤8.85.0Update to 8.86.0
- Medium5.3Missing Authorization
Five Star Restaurant Reservations – WordPress Booking Plugin
≤2.7.14Update to 2.7.15
- Medium5.3Missing Authorization
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce
≤2.161Update to 2.162
- Medium5.3Missing Authorization
AWP Classifieds
≤4.4.5Update to 4.4.6
- High8.8Authenticated (Author+) Local File Inclusion via 'path'
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.0.2Update to 2.0.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'rid' Parameter
ProfileGrid – User Profiles, Groups and Communities
≤5.9.8.4Update to 5.9.8.5
- High8.1Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field
coreActivity: Activity Logging for WordPress
≤3.0Update to 3.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Group Settings Modification
ProfileGrid – User Profiles, Groups and Communities
≤5.9.8.4Update to 5.9.8.5
- Medium4.3Authenticated (Author+) Missing Authorization to Widget Configuration Modification
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.0.2Update to 2.0.3