Database
WordPress Vulnerability Database (page 274)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Arbitrary File Upload
User Registration Advanced Fields
≤1.6.20Update to 1.6.21
- Medium5.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter
App Builder – Create Native Android & iOS Apps On The Flight
≤5.6.1Update to 5.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Simple Link Directory – AI Powered
≤8.9.2Update to 8.9.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API
MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites
≤2.1.9Update to 2.1.10
- Medium5.3Unauthenticated Information Disclosure in Store Reviews REST API Endpoint
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤4.3.1Update to 4.3.2
- High8.1Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
WCFM – Frontend Manager for WooCommerce
≤6.7.25Update to 6.7.26
- High7.5Unauthenticated Time-Based SQL Injection via 'sort' Parameter
Geo Mashup
≤1.13.18Update to 1.13.19
- High7.2Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input
Gravity Forms
≤2.9.30Update to 2.9.31
- High7.1Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
≤3.6.5Update to 3.6.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater
Gravity Forms
≤2.10.0Update to 2.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Product Option
Gravity Forms
≤2.10.0Update to 2.10.1
- High8.8Authenticated (Contributor+) Remote Code Execution via Display Logic
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets
≤4.2.2Update to 4.2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings
Call for Price for WooCommerce
≤4.2.0Update to 4.3.0
- High7.2Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1057Update to 1.7.1058
- High7.2Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater
Gravity Forms
≤2.10.0Update to 2.10.1
- Medium6.4Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode
NextMove Lite – Thank You Page for WooCommerce
≤2.23.0Update to 2.24.0
- High7.5Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter
Geo Mashup
≤1.13.18Update to 1.13.19
- High8.8Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg_save_provider_config' AJAX Action
WP Mail Gateway
≤1.8Update to 1.8.1
- High7.5Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter
Geo Mashup
≤1.13.18Update to 1.13.19
- Medium5.4Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action
My Social Feeds – bring your social content into WordPress
≤1.0.4Update to 1.0.5
- Medium5.3Authenticated (Custom+) Path Traversal
WP Customer Area
≤8.3.4Update to 8.3.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater
Gravity Forms
≤2.10.0Update to 2.10.1
- Critical9.8Authentication Bypass to Account Takeover
Temporary Login
≤1.0.0Update to 1.1.0
- Medium6.1Reflected DOM-Based Cross-Site Scripting via url Parameter
Lightbox & Modal Popup WordPress Plugin – FooBox
≤2.7.33Update to 2.7.34
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Elementor Website Builder – more than just a page builder
≤4.0.4Update to 4.0.5
- High8.8Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
WP Editor
≤1.2.9.2Update to 1.2.9.3
- Medium4.3Cross-Site Request Forgery to Module Activation/Deactivation
Ultimate Dashboard – Custom WordPress Dashboard
≤3.8.14Update to 3.8.15
- High7.5Unauthenticated SQL Injection
JetEngine
≤3.8.8.1Update to 3.8.8.2
- Medium5.3Missing Authorization to Unauthenticated Rollback Cancellation
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
≤1.17.1Update to 1.17.2
- Medium5.3Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter
Five Star Restaurant Reservations – WordPress Booking Plugin
≤2.7.16Update to 2.7.17