Database
WordPress Vulnerability Database (page 287)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
Travel & Tours Meta Search
≤2.3No patch available
- Medium6.1Reflected Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.5Update to 5.1.6
- Medium5.3Missing Authorization
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.1.2Update to 1.1.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.60Update to 1.2.61
- Critical9.8Missing Authorization to Unauthenticated Arbitrary File Upload
Quick Playground
≤1.3.1Update to 1.3.2
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content
Ultimate FAQ Accordion Plugin
≤2.4.7Update to 2.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Download Manager
≤3.3.52Update to 3.3.53
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute
Post Blocks & Tools
≤1.3.0Update to 1.3.1
- High8.1Unauthenticated Arbitrary File Move via regenerate_upload_file_keys
MW WP Form
≤5.1.1Update to 5.1.2
- Medium5.4Cross-Site Request Forgery to Form Entry Deletion
Advanced Contact form 7 DB
≤2.0.9Update to 2.1.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export
Advanced Contact form 7 DB
≤2.0.9Update to 2.1.0
- Critical9.8Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess
ProSolution WP Client
≤1.9.9Update to 2.0.0
- High7.5Unauthenticated SQL Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.38Update to 1.15.39
- High7.2Unauthenticated Stored Cross-Site Scripting
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
<5.5.0Update to 5.5.0
- Medium5.3Unauthenticated Information Exposure
Backup Migration
≤2.1.1Update to 2.1.2
- High7.5Unauthenticated SQL Injection
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.1Update to 4.9.2
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action
Ziggeo
≤3.1.1Update to 3.1.2
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode
List category posts
≤0.94.0Update to 0.95.0
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'
Vertex Addons for Elementor
≤1.6.4Update to 1.7.0
- High8.1Unauthenticated Local File Inclusion
Getaway - Travel & Tourism WordPress Theme
<1.8Update to 1.8
- High8.1Hotel Booking WordPress Theme <= 2.1.2 - Unauthenticated PHP Object Injection
Alloggio - Hotel Booking WordPress Theme
≤2.1.2Update to 2.1.3
- High8.1Unauthenticated PHP Object Injection
Valiance - Business Consulting WordPress Theme
≤1.2Update to 1.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
WP-BusinessDirectory – Business directory plugin for WordPress
≤4.0.0Update to 4.0.1
- High7.5Unauthenticated SQL Injection
Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce
≤1.2.0Update to 1.2.1
- High8.1Unauthenticated Local File Inclusion
Malmö - A Charming Multi-concept WordPress Theme
≤2.2Update to 2.3
- High8.1Unauthenticated PHP Object Injection
SingleMalt - Drink Store WordPress Theme
≤1.5Update to 1.6
- High7.5Missing Authorization
AWP Classifieds
≤4.4.4Update to 4.4.5
- Medium4.3Cross-Site Request Forgery
Ninja Forms - File Uploads
≤3.3.26No patch available
- High8.1Unauthenticated Local File Inclusion
Hitek - Electronics WooCommerce Theme
<1.8.3Update to 1.8.3
- High8.1Modern Furniture Store WordPress Theme <= 1.8.1 - Unauthenticated PHP Object Injection
Töbel - Modern Furniture Store WordPress Theme
≤1.8.1Update to 1.9