Database
WordPress Vulnerability Database (page 277)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.0.0Update to 11.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rescue Shortcodes
≤3.3Update to 3.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
E-cab Taxi Booking Manager for Woocommerce
≤2.0.0Update to 2.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Time Slots Booking Form
≤1.2.46Update to 1.2.47
- Medium5.3Missing Authorization
Metro Magazine
≤1.4.1Update to 1.4.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.16.13Update to 4.16.14
- Medium4.3Authenticated (Subscriber+) Information Exposure
WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS
≤7.2.1Update to 7.2.2
- Medium4.3Missing Authorization
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤5.6.7Update to 5.6.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Kapee - Modern Multipurpose WooCommerce Theme
<1.7.1Update to 1.7.1
- Medium4.3Missing Authorization
Bookify – Appointment Booking & Scheduling for WordPress
≤1.1.1Update to 1.1.2
- Medium4.3Missing Authorization
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤7.9.7Update to 7.9.9
- High7.2Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
≤9.1.2Update to 9.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
WP Store Locator
≤2.2.261Update to 2.3.0
- Critical9.8Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
Breeze Cache
≤2.4.4Update to 2.4.5
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor
≤3.5.5Update to 3.5.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via id
Social Rocket – Social Sharing Plugin
≤1.3.4.2Update to 1.3.5
- Medium4.3Missing Authorization
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤3.7.3Update to 3.8.0
- High8.1Unauthenticated PHP Object Injection
Kapee - Modern Multipurpose WooCommerce Theme
<1.7.0Update to 1.7.0
- High7.5Unauthenticated SQL Injection
Feed KuantoKusta for WooCommerce – Free
≤5.3Update to 5.3.1
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Link Library
≤7.8.8Update to 7.8.9
- High8.1Unauthenticated PHP Object Injection
Alukas – Luxury Jewelry Store WooCommerce WordPress Theme
<3.0.0Update to 3.0.0
- Medium5.3Missing Authorization
WPAdverts – Classifieds Plugin
≤2.3.0Update to 2.3.1
- Medium4.3Authenticated (Contributor+) Remote Code Execution
Blocksy Companion Pro
≤2.1.37Update to 2.1.38
- High8.1Unauthenticated PHP Object Injection
PressMart - Modern Elementor WooCommerce WordPress Theme
≤1.2.26Update to 1.2.27
- Medium5.3Missing Authorization
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<6.6.0Update to 6.6.0
- Medium4.3Cross-Site Request Forgery
Avada | Website Builder For WordPress & WooCommerce
<7.13.2Update to 7.13.2
- Medium5.3Missing Authorization
Bookit — Booking & Appointment Calendar
≤2.5.1Update to 2.5.4.1
- High8.1Unauthenticated PHP Object Injection
EmallShop - Responsive WooCommerce WordPress Theme
≤2.4.21Update to 2.4.22
- Medium5.3Missing Authorization
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤2.3.6Update to 2.3.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form to Any API
≤3.0.3Update to 3.0.4