Database
WordPress Vulnerability Database (page 295)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
WPGraphQL
≤2.9.1Update to 2.10
- Critical9.1Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users
WP DSGVO Tools (GDPR)
≤3.1.38Update to 3.1.39
- High7.5Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter
JetEngine
≤3.8.6.1Update to 3.8.6.2
- Medium6.5Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE
Product Filter for WooCommerce by WBW
≤3.1.2Update to 3.1.3
- Medium6.5Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
LearnDash LMS
≤5.0.3Update to 5.0.3.1
- Medium5.4Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.4Update to 5.1.5
- High8.1Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤28.1.5Update to 28.1.6
- Critical9.8Unauthenticated Remote Code Execution via Custom Pricing Formula
Woocommerce Custom Product Addons Pro
≤5.4.1Update to 5.4.2
- High8.8Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import
Jupiter X Core
≤4.14.1Update to 4.14.2
- High7.5Unauthenticated SQL Injection via 'radius' Parameter
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.4.8Update to 2.4.9
- Medium6.5Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤10.3.5Update to 11.0.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.2.8Update to 4.3.3
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search
Smart Custom Fields
≤5.0.6Update to 5.0.7
- Medium5.3Missing Authorization
User Verification by PickPlugins
≤2.0.45Update to 2.0.46
- Medium6.1Reflected Cross-Site Scripting
Car Dealer Automotive WordPress Theme – Responsive
≤1.6.7Update to 1.6.8
- High8.8Authenticated (Contributor+) Remote Code Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.5.6.1Update to 3.5.6.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
≤2.2.6Update to 2.2.7
- High8.1Unauthenticated PHP Object Injection
Kamperen - Camping and Adventure Tourism WordPress Theme
<1.3Update to 1.3
- Medium4.3Missing Authorization
WP Configurator Pro
≤3.7.9Update to 3.8.0
- Medium5.3Missing Authorization
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤28.1.2.2Update to 28.1.3
- Medium5.3Missing Authorization
WP Cost Estimation
<10.3.0Update to 10.3.0
- High7.5Unauthenticated SQL Injection
Addon Jobsearch Chat
≤3.0Update to 3.1
- High7.5Unauthenticated SQL Injection
Product Filter for WooCommerce by WBW
<3.1.3Update to 3.1.3
- Medium6.5Authenticated (Contributor+) SQL Injection
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.10.1.2Update to 2.10.1.5
- Medium5.3Missing Authorization
Five Star Restaurant Reservations – WordPress Booking Plugin
≤2.7.9Update to 2.7.10
- Medium5.3Missing Authorization
Salon Booking System Pro
<10.30.12Update to 10.30.12
- High8.1Unauthenticated PHP Object Injection
KIDZ - Kids Store and Baby Shop Theme
≤5.24Update to 5.25
- High8.1Unauthenticated PHP Object Injection
Goldish - Jewelry Store WooCommerce Theme
<3.47Update to 3.47
- High8.8Authenticated (Contributor+) Remote Code Execution
SimpLy Gallery
≤3.3.2Update to 3.3.2.1
- High8.1Unauthenticated Arbitrary File Deletion
Product File Upload for WooCommerce
≤2.2.4Update to 2.2.5