Database
WordPress Vulnerability Database (page 291)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
Page Builder: Pagelayer – Drag and Drop website builder
≤2.0.8Update to 2.0.9
- High8.1Unauthenticated Local File Inclusion
TheGov Core
<2.0.23Update to 2.0.23
- Medium5.3Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.3.7Update to 6.3.8
- Medium6.5Cross-Site Request Forgery to Product Data Modification
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.5Update to 1.1.6
- High8.1Unauthenticated Local File Inclusion
Integrio Core
<1.2.8Update to 1.2.8
- Medium5.3Missing Authorization
LTL Freight Quotes – Worldwide Express Edition
≤5.2.1Update to 5.2.2
- High7.5Unauthenticated Time-Based SQL Injection
WCAPF – Ajax Product Filter for WooCommerce
≤4.2.3Update to 4.3.0
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤6.6.26Update to 6.6.27
- Medium5.3Missing Authorization to Unauthenticated Settings Change
Link Whisper Free
<0.9.1Update to 0.9.1
- Medium5.3Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.9.7Update to 1.8.10
- High8.8Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
Booking for Appointments and Events Calendar – Amelia
≤2.1.3Update to 2.2
- Critical9.8File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
Ninja Forms - File Uploads
≤3.3.26Update to 3.3.27
- Medium6.5Authenticated (Contributor+) SQL Injection
Media Library Assistant
≤3.34Update to 3.35
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.34Update to 3.35
- Medium5.3Unauthenticated Information Exposure
IDPay Payment Gateway for Woocommerce
≤2.2.5No patch available
- Medium5.3Unauthenticated Information Exposure
Bricksforge
≤3.1.8.4Update to 3.1.8.5
- Medium5.3Missing Authorization to Unauthenticated Backup Upload to Offline Storage
Backup Migration
≤2.0.0Update to 2.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.7.9Update to 3.8.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.16.11Update to 4.16.12
- High8.8Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
wpForo Forum
≤2.4.16Update to 2.4.17
- High7.2Unauthenticated Stored Cross-Site Scripting
Visitor Traffic Real Time Statistics
≤8.4Update to 8.5
- High7.5Use of Hardcoded Password to Unauthenticated Remote Database Access
Text to Speech – TTSWP
≤1.9.8Update to 1.9.9
- Medium5.3Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media Upload
Listeo-Core - Directory Plugin by Purethemes
≤2.0.27Update to 2.0.28
- High7.2Unauthenticated Stored Cross-Site Scripting via feed_data
Widgets for Social Photo Feed
≤1.7.9Update to 1.8.0
- High7.1Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.16.11Update to 4.16.12
- Medium4.3Missing Authorization to Authenticated (Contributor+) Media Upload
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.6.3Update to 3.6.4
- Medium6.4Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤6.7.5Update to 6.7.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤3.7.9Update to 3.8.0
- High8.1WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
WCFM – Frontend Manager for WooCommerce
≤6.7.25Update to 6.7.26
- Medium6.4authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode
Shortcodes Ultimate – Content Elements
≤7.4.8Update to 7.4.9