Database
WordPress Vulnerability Database (page 273)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.0Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary SQL Modification
WP Business Intelligence Lite
≤3.2.0No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
≤4.10.0Update to 4.10.1
- Critical9.8Unauthenticated Privilege Escalation in mentoring_process_registration
Mentoring
≤1.2.8Update to 1.2.9
- Medium4.9Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter
Loco Translate
≤2.8.2Update to 2.8.3
- Critical9.8Authentication Bypass via Waitlist Guest Verification Token Reuse
MoreConvert Pro
≤1.9.14Update to 1.9.15
- Medium5.3Unauthenticated Denial of Service
Conditional Fields for Contact Form 7
≤2.7.2Update to 2.7.3
- High7.5Unauthenticated SQL Injection
WebinarIgnition – AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside
<4.09.86Update to 4.09.86
- Medium5.3Insecure Direct Object Reference to Unauthenticated Information Exposure
Easy PayPal Events & Tickets
≤1.3Update to 1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Membership
≤4.7.2Update to 4.7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.1.11Update to 9.1.12
- Medium5.3Missing Authorization
Flipmart - MegaOne Multipurpose WordPress Theme
≤2.8No patch available
- Medium5.3Missing Authorization
Event Tickets and Registration
≤5.27.5Update to 5.27.6.1
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.70Update to 4.11.71
- Medium5.8Unauthenticated Stored Cross-Site Scripting via 'rate_reason'
Quiz Maker by AYS
≤6.7.1.29Update to 6.7.1.30
- High7.5Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.30.25Update to 10.30.26
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute
Total
≤2.2.1Update to 2.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value
Brizy – Page Builder
≤2.8.11Update to 2.8.12
- Medium5.3Missing Authorization to Unauthenticated Form Action Meta Modification
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1056Update to 1.7.1057
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handler
FundPress – WordPress Donation Plugin
≤2.0.8Update to 2.0.9
- Medium5.3Unauthenticated Authorization Bypass via Remote Approval Endpoint
Booking for Appointments and Events Calendar – Amelia
≤2.2.1Update to 2.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter
Geo Mashup
≤1.13.19Update to 1.13.20
- High7.5Unauthenticated SQL Injection via 'orderby' Parameter
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤5.5Update to 5.6
- High8.1Unauthenticated PHP Object Injection
Profile Builder Pro
≤3.14.5Update to 3.14.6
- High7.2Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter
PixelYourSite Pro – Your smart PIXEL (TAG) Manager
≤12.5.0.1Update to 12.5.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
≤3.1.0Update to 3.1.1
- Medium4.4Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter
Ona
≤1.26Update to 1.27
- High8.8Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
Import and export users and customers
≤2.0.8Update to 2.0.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤6.0.4Update to 6.1.0
- Medium6.5Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints
Widgets for Social Photo Feed
≤1.8Update to 1.8.1
- Critical9.8Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint
User Verification by PickPlugins
≤2.0.46Update to 2.0.47