Database
WordPress Vulnerability Database (page 272)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download
All-in-One WP Migration Unlimited Extension
≤2.83Update to 2.84
- Medium4.3Missing Authorization
WP Business Intelligence Lite
≤3.2.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute
Snow Monkey Blocks
≤24.1.11Update to 24.1.12
- High8.8Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload
Betheme
≤28.4Update to 28.4.1
- Medium6.5Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'
Betheme
≤28.4Update to 28.4.1
- Medium4.3Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.4Update to 5.1.5
- High7.5Unauthenticated SQL Injection via 'inputs'
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.42Update to 1.15.43
- Medium6.5Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements
GenerateBlocks
≤2.2.0Update to 2.2.1
- High7.5Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.52.1Update to 1.52.2
- High7.5Unauthenticated SQL Injection via 'consent' Parameter
WeePie Cookie Allow
≤3.4.11Update to 3.4.12
- Medium5.3Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.52.0Update to 1.52.1
- Medium6.5Missing Authorization to Unauthenticated Widget Content Overwrite
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤3.8.2Update to 3.9.0
- Critical9.8Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action
Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce
≤1.2.2Update to 1.2.3
- High7.5Unauthenticated SQL Injection via 'attributekey'
Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce
≤1.2.0Update to 1.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute
AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel
≤2.7.10Update to 2.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1056Update to 1.7.1057
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤3.5.3Update to 3.6.0
- Medium6.5Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter
EmailKit – Email Customizer for WooCommerce & WP
≤1.6.5Update to 1.6.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1056Update to 1.7.1057
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤3.5.3Update to 3.6.0
- Medium6.5Improper Authorization to Unauthenticated Arbitrary Subscription Management
Subscribe To Comments Reloaded
≤240119No patch available
- High7.5Unauthenticated SQL Injection via 'regions'
AWP Classifieds
≤4.4.6Update to 4.4.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute
Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website
≤2.1.0No patch available
- Medium6.1Reflected Cross-Site Scripting via 'page' Parameter
Blog Settings
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting via 'email' Parameter
Zingaya Click-to-Call
≤1.0No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter
Publish 2 Ping.fm
≤1.1No patch available
- Medium4.3Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page
addfreespace
≤0.1.3No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
DX Sources
≤2.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
WP-Clippy
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute
Simple Owl Shortcodes
≤2.1.1No patch available