Database
WordPress Vulnerability Database (page 285)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute
VI: Include Post By
≤0.4.200706No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie
Login as User – Switch User & WooCommerce Login as Customer
≤1.0.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Quick Interest Slider
≤3.1.5Update to 3.1.6
- Medium4.3Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter
Inquiry form to posts or pages
≤1.0No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
WebStack
≤1.2024No patch available
- Medium5.3Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters
Advanced Custom Fields (ACF®)
≤6.7.0Update to 6.7.1
- Medium5.4Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
Avada (Fusion) Builder
≤3.15.1Update to 3.15.2
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
Avada (Fusion) Builder
≤3.15.1Update to 3.15.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
Age Verification & Identity Verification by Token of Trust
≤3.32.3Update to 3.32.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Event Description
List View Google Calendar
≤7.4.3Update to 7.4.4
- Medium6.5Authenticated (Subscriber+) Arbitrary Directory Deletion
Eleganzo
≤1.2Update to 1.3
- Medium5.3Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
≤1.16.17Update to 1.16.18
- Medium5.3Missing Authorization to Unauthenticated Order Status Modification
Nexi XPay
≤8.3.0Update to 8.3.2
- Medium4.3Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.8Update to 4.1.9
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Germanized for WooCommerce
≤3.20.5Update to 3.20.6
- High7.2Authenticated (Administrator+) PHP Object Injection
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News
≤3.0.12Update to 3.0.13
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
WholeSale Products Dynamic Pricing Management WooCommerce
≤1.2Update to 1.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤3.3.5Update to 3.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Surbma | Booking.com Shortcode
≤2.1Update to 2.1.1
- High7.2Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter
BackWPup – WordPress Backup & Restore Plugin
≤5.6.6Update to 5.6.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.40Update to 1.15.41
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.2.8Update to 4.3.3
- High7.5Unauthenticated SQL Injection via '_cct_search' Parameter
JetEngine
≤3.8.6.1Update to 3.8.6.2
- Medium6.1Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.4Update to 5.1.5
- Medium5.3Missing Authorization
Booking Activities
≤1.16.48.1Update to 1.17.0
- High7.5Unauthenticated SQL Injection
Product Filter for WooCommerce by WBW
≤3.1.2Update to 3.1.3
- Medium5.3Unauthenticated Information Exposure
Magic Export & Import
≤1.1.0Update to 1.2.0
- High7.5Unauthenticated SQL Injection
WP Photo Album Plus
≤9.1.08.001Update to 9.1.08.002
- High7.5Authenticated (Contributor+) PHP Object Injection
Post Duplicator
≤3.0.10Update to 3.0.11
- High7.5Unauthenticated SQL Injection
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.152Update to 2.8.154