Database
WordPress Vulnerability Database (page 275)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Advanced Form Integration — Connect Forms to 300+ Apps
≤1.126.12Update to 1.127.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Favicon Rotator
≤1.2.11Update to 1.2.12
- High7.5Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
≤3.1.4Update to 3.1.5
- Medium4.3Missing Authorization
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
≤2.7.5Update to 2.7.6
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.3.9Update to 5.3.10
- High7.5Unauthenticated SQL Injection
GD Rating System
≤3.6.2Update to 3.7
- Medium5.3Missing Authorization
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤28.1.7Update to 29.0.0
- Medium5.3Missing Authorization
PowerPack Pro for Elementor
<v2.13.0Update to 2.13.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤28.1.6Update to 29.0.0
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤28.1.7Update to 29.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤5.6.7Update to 5.6.8
- High7.5Unauthenticated SQL Injection
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.7.7Update to 5.7.8
- Medium5.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.3.8Update to 5.3.9
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.8Update to 4.1.9
- Medium5.3Missing Authorization
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.19Update to 4.6.20
- Medium4.3Authenticated (Subscriber+) Information Exposure
WPPizza – A Restaurant Plugin
≤3.19.9Update to 3.20
- High7.2Unauthenticated Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.3.8Update to 5.3.9
- Medium5.3Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint
Complianz GDPR/CCPA Cookie Consent Banner
≤7.4.5Update to 7.4.6
- Medium4.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.2Update to 2.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Check & Log Email – Easy Email Testing & Mail logging
<2.0.13Update to 2.0.13
- Medium6.1Unauthenticated Stored Cross-Site Scripting via Comment
WP Meteor Website Speed Optimization Addon
≤3.4.16Update to 3.4.17
- Medium5.3Unauthenticated Price Manipulation via 'amount' Parameter
Booking Package
≤1.7.06Update to 1.7.07
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block
Woostify
≤2.5.0Update to 2.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
Timeline Blocks
≤1.1.10Update to 1.1.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed
Social Post Embed
≤2.0.1Update to 2.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
WPC Smart Messages for WooCommerce
≤4.2.8Update to 4.2.9
- High8.8Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.4.1Update to 5.4.2
- Medium4.3Authenticated (Contributor+) Information Exposure
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
≤3.6.1Update to 3.6.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
TheGem Theme Elements
<5.12.1.1Update to 5.12.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
<2.4.2Update to 2.4.2