Database
WordPress Vulnerability Database (page 286)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Jupiter X Core
≤4.14.1Update to 4.14.2
- High7.2Unauthenticated Stored Cross-Site Scripting
ManageWP Worker
≤4.9.31Update to 4.9.32
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Meta Box – A Framework for Dynamic Websites
≤5.11.1Update to 5.11.2
- Medium5.3Missing Authorization
Easy Appointments
≤3.12.21Update to 3.12.22
- High7.5Unauthenticated SQL Injection
SpeakOut! Email Petitions
≤4.6.5Update to 4.6.5.1
- High7.5Unauthenticated SQL Injection
WP Directory Kit
≤1.5.0Update to 1.5.1
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access
Frontend File Manager Plugin
≤23.6No patch available
- High7.1Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
wpForo Forum
≤3.0.2Update to 3.0.3
- Medium6.5Authenticated (Custom+) SQL Injection via 'order' Parameter
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
≤9.2.1Update to 9.2.2
- Medium5.0Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.58Update to 1.2.59
- High8.8Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR
BuddyPress Groupblog
≤1.9.3Update to 1.9.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute
BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library
≤2.2.15Update to 2.3.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
Tutor LMS – eLearning and online course solution
≤3.9.7Update to 3.9.8
- High7.2Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.2Update to 4.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute
Greenshift – animation and page builder blocks
≤12.8.9Update to 12.9.0
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
Tutor LMS – eLearning and online course solution
≤3.9.7Update to 3.9.8
- Medium6.1Reflected Cross-Site Scripting via Page Profiler URL
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.3Update to 4.2.4
- High7.1Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall
Gravity SMTP
≤2.1.4Update to 2.1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
AddFunc Head & Footer Code
≤2.3Update to 2.4
- Medium4.3Cross-Site Request Forgery to Plugin Settings Reset
Aruba HiSpeed Cache
≤3.0.4Update to 3.0.5
- Medium4.3Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.58Update to 1.2.59
- High7.5Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
Tutor LMS – eLearning and online course solution
≤3.9.7Update to 3.9.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter
Webling
≤3.9.0Update to 3.9.1
- Medium5.3Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter
Customer Reviews for WooCommerce
≤5.103.0Update to 5.104.0
- Medium6.1Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter
Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely
≤1.0.16Update to 1.0.17
- Medium4.3Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
Download Manager
≤3.3.51Update to 3.3.52
- High8.1Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter
Perfmatters
≤2.5.9Update to 2.6.0
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation
WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance
≤4.5.0Update to 4.5.1
- Medium6.1Reflected Cross-Site Scripting
Travel & Tours Meta Search
≤2.3No patch available
- Critical9.8Injected Backdoor
Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions
2.9.1 – 2.9.1Update to 2.9.1.1