Database
WordPress Vulnerability Database (page 293)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Ibtana – WordPress Website Builder
≤1.2.5.7Update to 1.2.5.8
- Medium5.3Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
TrueBooker – Appointment Booking and Scheduler System
≤1.1.4Update to 1.1.5
- Medium6.5Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax
WooPayments: Integrated WooCommerce Payments
≤10.5.1Update to 10.6.0
- Medium6.1Reflected Cross-Site Scripting via 'update_href' Parameter
Loco Translate
≤2.8.2Update to 2.8.3
- Medium5.3Unauthenticated Sensitive Information Exposure via REST API
Gravity SMTP
≤2.1.4Update to 2.1.5
- Critical9.8Unauthenticated Remote Code Execution via Calculation Field
Everest Forms Pro
≤1.9.12Update to 1.9.13
- High8.8Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
Debugger & Troubleshooter
≤1.3.2Update to 1.4.0
- Critical9.8Unauthenticated Server-Side Template Injection via Prefill Functionality
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.36Update to 1.8.0
- Medium5.3Missing Authorization
LeadConnector
<3.0.22Update to 3.0.22
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Lightbox 2
<3.0.7Update to 3.0.7
- Critical9.8Unauthenticated Arbitrary File Upload
ThemeREX Addons
<2.38.5Update to 2.38.5
- Critical9.8Unauthenticated Arbitrary Code Execution
Responsive Starter Templates – Elementor Templates & Starter Sites
<3.4.3Update to 3.4.3
- Medium4.9Authenticated (Shop manager+) SQL Injection
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.7.1Update to 1.1.8
- Medium4.3Authenticated (Contributor+) Arbitrary File Download
Shared Files – File Upload & Download Manager
<1.7.58Update to 1.7.58
- Medium6.5Authenticated (Contributor+) SQL Injection
Xpro Addons — 150+ Widgets for Elementor
≤1.5.1Update to 1.5.2
- High7.5Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'
Download Monitor
≤5.1.7Update to 5.1.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth'
Twentig Supercharged Block Editor – Blocks, Patterns, Starter Sites, Portfolio
≤1.9.7Update to 2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Advanced Coupons for WooCommerce – BOGO, Store Credit & WooCommerce Coupons
≤4.7.1.1Update to 4.7.2
- Medium4.3Missing Authorization
AI Engine (Pro)
<3.4.2Update to 3.4.2
- Medium5.3Missing Authorization
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
≤2.21.4Update to 2.21.5
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters
Quads Ads Manager for Google AdSense
≤2.0.98.1Update to 2.0.99
- Medium5.3Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
Page Builder: Pagelayer – Drag and Drop website builder
≤2.0.7Update to 2.0.8
- Medium6.5Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.14.1Update to 3.14.2
- High7.2Unauthenticated Server-Side Request Forgery via route_path
Oxygen - WooCommerce WordPress Theme
≤6.0.8Update to 6.0.9
- High7.5Unauthenticated Payment Amount Validation Bypass via 'form_id'
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.5.2Update to 2.6.0
- High8.0Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.11.2Update to 2.11.3
- High8.1Unauthenticated Local File Inclusion
Kiddy - Children WordPress theme
≤2.0.8Update to 2.0.9
- High7.5Unauthenticated Information Exposure
PeproDev Ultimate Invoice
<2.2.6Update to 2.2.6
- Medium5.3Missing Authorization
FOX – Currency Switcher Professional for WooCommerce
≤1.4.5Update to 1.4.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
OSM – OpenStreetMap
<6.1.15Update to 6.1.15