Database
WordPress Vulnerability Database (page 276)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
Order Delivery Date for WooCommerce
≤4.5.1Update to 4.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Profile Builder Pro
≤3.15.0Update to 3.15.1
- High8.1Unauthenticated PHP Object Injection
AI Lab - Machine Learning WordPress Theme
<5.4.2Update to 5.4.2
- Medium5.3Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.1Update to 4.3.2
- Medium5.3Missing Authorization
SureForms Pro
≤2.8.0Update to 2.8.1
- High7.5Unauthenticated SQL Injection
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.15.0.1Update to 3.15.0.2
- Medium5.3Unauthenticated Sensitive Information Exposure
Simply Schedule Appointments
<1.6.11.2Update to 1.6.11.2
- High8.8Authenticated (Subscriber+) Privilege Escalation
Highland Software Custom Role Manager
≤1.0.0Update to 1.0.1
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤3.0.3Update to 3.0.4
- Medium4.3Missing Authorization
Groundhogg — CRM, Newsletters, and Marketing Automation
<4.4.1Update to 4.4.1
- Medium5.3Unauthenticated Information Exposure
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
<3.0.7Update to 3.0.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
reCaptcha by WebDesignBy
<2.0Update to 2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
ITERAS
≤1.8.2Update to 1.8.3
- Medium4.3Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure
HubSpot All-In-One Marketing – Forms, Popups, Live Chat
≤11.3.32Update to 11.3.33
- Medium5.3Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint
Liaison Site Prober
≤1.2.1Update to 1.2.2
- Medium4.3Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action
Taqnix
≤1.0.3Update to 1.0.4
- Medium5.3Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.0Update to 4.8.1
- High8.1Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass
Drag and Drop File Upload for Contact Form 7
≤1.1.3Update to 1.1.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1056Update to 1.7.1057
- Medium5.3Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover
Booking Calendar Contact Form
≤1.2.63Update to 1.2.64
- Medium5.3Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
≤9.1.2Update to 9.1.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.3.11Update to 4.3.12
- Medium5.3Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter
MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites
≤2.1.8Update to 2.1.9
- Medium5.3Missing Authorization
MasterStudy LMS Pro
<4.7.16Update to 4.7.16
- High8.1Online Courses Education WordPress Theme <= 1.15.0 - Unauthenticated Local File Inclusion
Learnify - Online Courses Education WordPress Theme
≤1.15.0No patch available
- Medium4.3Missing Authorization
ACF Galerie 4
≤1.4.2Update to 1.4.3
- Medium5.3Unauthenticated Information Exposure
Booking for Appointments and Events Calendar – Amelia
≤2.2Update to 2.2.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
KiviCare – Clinic & Patient Management System (EHR)
≤4.2.1Update to 4.3.0
- Medium5.3Missing Authorization
bBlocks – Essential Gutenberg Blocks & Patterns Collection
<2.0.30Update to 2.0.30
- Medium6.1Reflected Cross-Site Scripting
Bricks
≤1.9.2Update to 2.3