Database
WordPress Vulnerability Database (page 298)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
VK All in One Expansion Unit
≤9.113.3Update to 9.113.4
- High8.1Unauthenticated PHP Object Injection
Ricky - Pet Shop & Care WooCoomerce Theme
<2.31Update to 2.31
- Medium6.1Reflected Cross-Site Scripting
Vayvo - Media Streaming & Membership WordPress Theme
<6.8Update to 6.8
- Medium6.1Reflected Cross-Site Scripting
Contact Manager
≤9.1Update to 9.1.1
- Medium5.3Missing Authorization
WPCargo Track & Trace
≤8.0.5Update to 8.0.6
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Ona
<1.24Update to 1.24
- Medium6.1Reflected Cross-Site Scripting
NaturaLife Extensions
≤2.1Update to 2.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
ProfileGrid – User Profiles, Groups and Communities
≤5.9.8.1Update to 5.9.8.2
- High7.2Authenticated (Editor+) Remote Code Execution
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤8.2.7Update to 8.2.8
- Medium6.5Authenticated (Subscriber+) SQL Injection
ElementInvader Addons for Elementor
≤1.4.2Update to 1.4.3
- Medium5.3Unauthenticated API Keys Disclosure
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.49Update to 51.1.51
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget And Countdown Widget
Sina Extension for Elementor
≤3.7.0Update to 3.7.1
- Medium5.3Unauthenticated Sensitive Information Exposure
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤2.2.12Update to 2.3.0
- High7.3Unauthenticated Limited Remote Code Execution
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤2.2.12Update to 2.3.0
- Medium5.3Unauthenticated Sensitive Information Exposure to Data Export
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤2.2.12Update to 2.3.0
- Medium6.5Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤2.2.10Update to 2.2.12
- High7.5Unauthenticated SQL Injection via 'orderby' Parameter
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.1Update to 4.9.2
- Medium4.9Authenticated (Editor+) SQL Injection
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.44.0Update to 3.45.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
≤4.9.4Update to 4.10.0
- Medium4.3Missing Authorization
12 Step Meeting List
≤3.19.9Update to 3.19.10
- Medium5.3Unauthenticated Information Exposure
Bus Ticket Booking with Seat Reservation
<5.6.5Update to 5.6.5
- Medium5.3Unauthenticated Information Exposure
12 Step Meeting List
≤3.19.9Update to 3.19.10
- Medium5.3Unauthenticated Information Exposure
Simple History – Track, Log, and Audit WordPress Changes
≤5.24.0Update to 5.24.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤27.1.1Update to 27.2
- High8.8Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module
WP Extended – Modular WordPress Toolkit
≤3.2.4Update to 3.2.5
- High8.1Privilege Escalation to Administrator via save_extra_user_profile_fields
Import and export users and customers
≤1.29.7Update to 2.0
- Medium4.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.1.7Update to 2.1.8
- High7.5Unauthenticated Arbitrary File Read via Media Field
JetFormBuilder — Dynamic Blocks Form Builder
≤3.5.6.2Update to 3.5.6.3
- Medium5.6Unauthenticated Blind Arbitrary Shortcode Execution
Contact Form, Survey, Quiz & Popup Form Builder – ARForms
≤1.7.4Update to 1.7.5
- High8.1Cross-Site Request Forgery to Arbitrary File Deletion
Invelity Product Feeds
≤1.2.6No patch available