Database
WordPress Vulnerability Database (page 290)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'maximum-num-years' Shortcode Attribute
Investi
≤1.0.26Update to 1.0.27
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode
Strong Testimonials
≤3.2.21Update to 3.2.22
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
TableOn – WordPress Posts Table Filterable
≤1.0.4.4Update to 1.0.5
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action
Users manager – PN
≤1.1.15Update to 1.1.20
- Medium5.3Missing Authorization to Unauthenticated Settings Update
LTL Freight Quotes – R+L Carriers Edition
≤3.3.13Update to 3.3.14
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat API
MainWP Child Reports
≤2.2.6Update to 2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.1.10Update to 4.1.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.3Update to 4.3.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.3.0Update to 5.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode Attribute
LightPress Lightbox
≤2.3.4Update to 2.3.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes
PowerPress Podcasting plugin by Blubrry
≤11.15.15Update to 11.15.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Elementor Website Builder – more than just a page builder
≤3.35.5Update to 3.35.6
- High8.813.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
13.4.6 – 13.5.2.1Update to 13.5.2.2
- Critical9.8Unauthenticated PHP Object Injection via Form Entry Metadata
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.4.3Update to 3.4.4
- Medium5.4Cross-Site Request Forgery to Download Path Deletion and Disabling
Download Monitor
≤5.1.10Update to 5.1.11
- Medium5.3Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.10.2Update to 7.8.11
- Medium6.1Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
Gravity Forms
≤2.9.30Update to 2.9.31
- Medium4.7Reflected Cross-Site Scripting via 'form_ids' Parameter
Gravity Forms
≤2.9.30Update to 2.9.31
- Medium5.4Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation
Smart Slider 3
≤3.5.1.33Update to 3.5.1.34
- Medium5.3Missing Authorization
Timetics – Appointment Booking Calendar & Scheduling
≤1.0.53Update to 1.0.54
- Medium4.3Cross-Site Request Forgery to Taxonomy Term Deletion
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.5Update to 1.1.6
- High8.8Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal
Advanced Members for ACF
≤1.2.5Update to 1.2.6
- Medium4.3Missing Authorization
Ocean Extra
≤2.5.3Update to 2.5.4
- Critical9.8Unauthenticated Privilege Escalation
iControlWP
≤5.5.3Update to 5.5.4
- High8.1Unauthenticated Local File Inclusion
Softlab Core
<1.2.11Update to 1.2.11
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Table & List Builder for WooCommerce
≤4.6.3Update to 4.6.4
- Medium4.3Cross-Site Request Forgery
Simple Social Media Share Buttons – Social Sharing for Everyone
≤6.2.0Update to 6.2.1
- Medium4.3Cross-Site Request Forgery
Under Construction, Coming Soon & Maintenance Mode
≤2.1.1Update to 2.1.2
- Medium5.3Missing Authorization
Event Tickets Manager for WooCommerce
≤1.5.3Update to 1.5.4
- Medium4.3Apartment Management System for wordpress < 49.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
WPAMS - Apartment Management System for wordpress
<49.5.3Update to 49.5.3