Database
WordPress Vulnerability Database (page 294)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤2.2.3Update to 2.2.4
- Medium4.3Missing Authorization
Spectra Legacy – Gutenberg Blocks
≤2.19.22Update to 2.19.23
- Medium4.3Missing Authorization
Petitioner
≤0.7.3Update to 0.7.4
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read via actionExportAll
Smart Slider 3
≤3.5.1.33Update to 3.5.1.34
- Medium5.3Unauthenticated Information Exposure
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
≤4.7.0Update to 4.7.1
- Medium4.3Missing Authorization
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.0.2Update to 4.0.3
- Medium4.9Authenticated (Editor+) SQL Injection
Broken Link Checker
≤2.4.7Update to 2.4.8
- Medium5.3Missing Authorization
Share This Image
≤2.12Update to 2.13
- Medium5.3Unauthenticated Information Exposure
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
<3.6.2Update to 3.6.2
- Medium6.5Authenticated (Contributor+) SQL Injection
Simply Schedule Appointments
≤1.6.9.27Update to 1.6.9.29
- Medium5.3Missing Authorization
Seriously Simple Podcasting
≤3.14.2Update to 3.14.3
- Medium4.3Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
Elementor Website Builder – more than just a page builder
≤3.35.7Update to 3.35.8
- High8.89.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change
Booking for Appointments and Events Calendar – Amelia
8.3 – 9.1.2Update to 9.2
- Medium5.3Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow
FormLift for Keap (Legacy) Web Forms
≤7.5.21Update to 7.5.22
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action
Blog2Social: Social Media Auto Post & Scheduler
≤8.8.2Update to 8.8.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'sbox_id' Shortcode Attribute
BWL Advanced FAQ Manager Lite
≤1.1.1Update to 1.1.2
- High7.2Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts
ACF Frontend Admin by DynamiApps
≤3.28.31Update to 3.28.32
- Medium6.1Reflected Cross-Site Scripting via 'noresults' Parameter
FloristPress for Woo – Customize your eCommerce store for your Florist
≤7.8.2Update to 7.8.3
- High8.8Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.1.6Update to 2.1.7
- High8.8Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.4.9Update to 2.5.0
- High7.5Unauthenticated SQL Injection via 'multiformid' Parameter
JS Help Desk – AI-Powered Support & Ticketing System
≤3.0.4Update to 3.0.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.0.01Update to 2.0.05
- Medium6.5Authenticated (Contributor+) SQL Injection
Download Monitor
≤5.1.8Update to 5.1.9
- Medium4.3Cross-Site Request Forgery to Menu Options Update
Conditional Menus
≤1.2.6Update to 1.2.7
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
≤6.4.3Update to 6.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header
Blackhole for Bad Bots
≤3.8Update to 3.8.1
- Medium6.5Authenticated (Custom role+) SQL Injection
Booking for Appointments and Events Calendar – Amelia
≤2.1.1Update to 2.1.2
- Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting via Content Filter
Complianz GDPR/CCPA Cookie Consent Banner
≤7.4.4.2Update to 7.4.5
- Medium5.3Unauthenticated Information Exposure
Instantio — Side Cart & One-Page Checkout for WooCommerce
≤3.3.30Update to 3.3.31
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute
Simple Download Counter
≤2.3Update to 2.3.1