Database
WordPress Vulnerability Database (page 271)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) PHP Object Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.1Update to 4.3.2
- Medium5.3Missing Authorization
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1053Update to 1.7.1053
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Refund Initiation
Eupago Gateway For Woocommerce
≤4.7.1Update to 4.7.2
- Medium4.3Missing Authorization
bunny.net – WordPress CDN Plugin
≤2.3.6Update to 2.3.7
- Medium5.3Unauthenticated Insecure Direct Object Reference
YITH WooCommerce Wishlist
≤4.12.0Update to 4.13.0
- Medium4.9Authenticated (Editor+) SQL Injection
Team Members – Multi Language Supported Team Plugin
≤8.5Update to 8.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1053Update to 1.7.1053
- High7.5Unauthenticated SQL Injection
eMagicOne Store Manager for WooCommerce
≤1.3.2No patch available
- Medium4.3Cross-Site Request Forgery
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.5Update to 1.1.6
- Medium5.3Missing Authorization
PDF Poster – Let visitors read PDF’s without leaving the page
≤2.4.1Update to 2.5.0
- High7.5Unauthenticated SQL Injection
wpForo Forum
≤3.0.4Update to 3.0.5
- Medium4.3Cross-Site Request Forgery
WPGraphQL
≤2.5.3Update to 2.5.4
- Medium5.3Unauthenticated Information Exposure
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.20.8Update to 3.21.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WEN Logo Slider
≤3.4.0Update to 3.5
- Medium5.3Missing Authorization
Bus Ticket Booking with Seat Reservation
<5.6.8Update to 5.6.8
- High8.87.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url
Slider Revolution
7.0.0 – 7.0.10Update to 7.0.11
- High8.1Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta
WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance
≤4.5.2Update to 4.5.3
- High7.5Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter
BetterDocs Pro
≤3.7.0Update to 3.7.1
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.53.0Update to 1.53.0.1
- Medium6.5Unauthenticated Arbitrary Appointment View, Modification and Deletion
Simply Schedule Appointments
≤1.6.10.6Update to 1.6.11
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.51.1Update to 1.52
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliate Program Suite — SliceWP Affiliates
≤1.2.6Update to 1.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.5.0Update to 5.5.1
- High7.5Unauthenticated SQL Injection via 'category_id' Parameter
Gravity Bookings
≤2.5.9Update to 2.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.5.0Update to 5.5.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.5.0Update to 5.5.1
- Medium4.9Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.1Update to 6.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode
Affiliate Program Suite — SliceWP Affiliates
≤1.2.7Update to 1.2.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤5.2.6Update to 5.2.7
- Medium5.3Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure
Mercado Pago payments for WooCommerce
≤8.7.11Update to 8.7.12