Database
WordPress Vulnerability Database (page 292)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode
Shortcodes Ultimate – Content Elements
≤7.4.7Update to 7.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1049Update to 1.7.1050
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode
Simple Shopping Cart
≤5.2.4Update to 5.2.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.11.1Update to 2.11.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Xpro Addons — 150+ Widgets for Elementor
≤1.4.20Update to 1.4.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤3.4.6Update to 3.4.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget
Xpro Addons — 150+ Widgets for Elementor
≤1.4.24Update to 1.4.25
- Medium6.5Missing Authorization to Unauthenticated Registration Form Status Modification
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.4.8Update to 3.8.4.9
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter
Perfmatters
≤2.5.9.1Update to 2.6.0
- Critical9.8Unauthenticated Remote Code Execution
StackWC Order Notification for WooCommerce – Get Instant Audio Alert on new Orders
<3.6.3Update to 3.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MSTW League Manager
≤2.10No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode
Extensions for Leaflet Map
≤4.14Update to 4.15
- High7.5Unauthenticated Information Exposure
Export All URLs
<5.1Update to 5.1
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
Webmention
≤5.6.2Update to 5.7.0
- High7.2Unauthenticated Blind Server-Side Request Forgery
Webmention
≤5.6.2Update to 5.7.0
- High7.5Unauthenticated Security Token Exposure via User-Agent Header
W3 Total Cache
≤2.9.3Update to 2.9.4
- High8.1Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir
MW WP Form
≤5.1.0Update to 5.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Addons for WPBakery
<3.21.4Update to 3.21.4
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Database for Contact Form 7, WPforms, Elementor forms
≤1.4.9Update to 1.5.0
- Medium6.5Authenticated (Manager+) SQL Injection via 'sort' Parameter
Booking for Appointments and Events Calendar – Amelia
≤2.1.2Update to 2.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
Shortcodes Ultimate – Content Elements
≤7.4.10Update to 7.5.0
- Medium5.3Missing Authorization
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1056Update to 1.7.1057
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kubio AI Page Builder
≤2.7.0Update to 2.7.1
- Medium4.3Cross-Site Request Forgery
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤1.10.0.2Update to 1.10.0.3
- Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.53Update to 51.1.54
- Medium5.3Missing Authorization
Simple Membership
≤4.7.1Update to 4.7.2
- High7.2Reflected Cross-Site Scripting via Request URI
Query Monitor
≤3.20.3Update to 3.20.4
- Medium5.4Cross-Site Request Forgery to Plugin Settings Update
Minify HTML
≤2.1.12Update to 2.1.13
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.15.5Update to 3.15.6
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page
Auto Post Scheduler
≤1.84No patch available