Database
WordPress Vulnerability Database (page 279)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
WPMK Block
≤1.0.1No patch available
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read
Breaking News WP
≤1.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
Posts map
≤0.1.3No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block
Zypento Blocks
≤1.06No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting
Buzz Comments
≤0.9.4No patch available
- Medium4.3Cross-Site Request Forgery to Settings Modification via fff_save_settins AJAX Action
Fast & Fancy Filter – 3F
≤1.2.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute
Text Snippets
≤0.0.1No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update via Settings Page
Google PageRank Display
≤1.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute
SlideShowPro SC
≤1.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode Attribute
Simple Random Posts Shortcode
≤0.3No patch available
- Critical9.8Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests
Sendmachine for WordPress
≤1.0.20Update to 2.0.0
- High8.8Authenticated (Subscriber+) Remote Code Execution
FunnelFormsPro
≤3.8.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Min Max Step Quantity Limits Manager for WooCommerce
≤5.2.2Update to 5.2.3
- High7.5Unauthenticated SQL Injection
WPGraphQL
<2.11.1Update to 2.11.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Email Encoder – Protect Email Addresses and Phone Numbers
<2.3.4Update to 2.3.4
- Medium5.3Missing Authorization
Booking Package
≤1.7.06Update to 1.7.07
- Medium6.1Reflected Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.14.2Update to 4.14.3
- Medium5.3Missing Authorization
wpForo Forum
<3.0.2Update to 3.0.2
- Medium4.3Missing Authorization
Motors – Car Dealership & Classified Listings Plugin
<1.4.107Update to 1.4.107
- Medium5.3Missing Authorization
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP
≤1.4.2Update to 1.4.3
- High7.5Unauthenticated SQL Injection
ListingPro Plugin
≤2.9.10Update to 2.9.11
- High7.5Unauthenticated SQL Injection
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤28.1.6Update to 28.1.7
- High8.8Unauthenticated Arbitrary File Upload
Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce
≤1.2.2Update to 1.2.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.25Update to 3.7.26
- Medium5.3Unauthenticated Insecure Direct Object Reference
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.30.24Update to 10.30.25
- High7.2Unauthenticated Stored Cross-Site Scripting
Coupon Affiliates – Affiliate Plugin for WooCommerce
≤7.5.3Update to 7.6.0
- Critical9.8Unauthenticated Arbitrary File Upload
Embed HTML5 Game
≤1.3No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion
Contact Form Extender for Divi – Submissions DB & Extra Fields
≤1.0.6Update to 1.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Chatbot for WordPress by Collect.chat ⚡️
≤2.4.9Update to 2.5.0
- Medium4.3Missing Authorization
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.9Update to 4.7.10