Database
WordPress Vulnerability Database (page 305)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Contextual Related Posts
<4.2.2Update to 4.2.2
- High7.5Missing Authorization to Unauthenticated Arbitrary Content Deletion
Fraud Prevention For WooCommerce and EDD
≤2.3.3Update to 2.3.4
- Medium4.3Cross-Site Request Forgery
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)
≤1.11.0Update to 1.12.0
- Medium6.1Reflected Cross-Site Scripting
Kentha - Music WordPress Theme
≤4.7.2No patch available
- Medium4.3Missing Authorization
UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
≤1.10.1Update to 1.11.0
- High8.1Unauthenticated PHP Object Injection
Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
≤1.1.1No patch available
- High8.1Unauthenticated PHP Object Injection
SUMO Affiliates Pro
<11.4.0Update to 11.4.0
- Medium5.3Missing Authorization
GZSEO
≤2.0.14Update to 2.0.15
- Medium5.3Unauthenticated Information Exposure
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.3.10Update to 4.3.11
- Medium5.3Missing Authorization
Print Invoice & Delivery Notes for WooCommerce
≤5.9.0Update to 6.0.0
- Medium5.3Missing Authorization
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.2.8.3Update to 4.2.8.4
- Medium4.7Unauthenticated Open Redirect
Hide My WP Ghost – Security & Firewall
<7.0.00Update to 7.0.00
- Medium4.3Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
Download Manager
≤3.3.49Update to 3.3.50
- High7.5Authenticated (Subscriber+) PHP Object Injection
Wishlist Member
≤3.32.0Update to 3.33.0
- High8.8Authenticated (Author+) Remote Code Execution
Widget Wrangler
≤2.3.9No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'fh'
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.3.5Update to 5.4.0
- Medium5.4Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite
Yoast Duplicate Post
≤4.5Update to 4.6
- Medium6.1Reflected Cross-Site Scripting via 'p' Parameter
Writeprint Stylometry
≤0.1No patch available
- Medium6.1Reflected Cross-Site Scripting
[CR]Paid Link Manager
≤0.5Update to 0.6
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
Subscriptions for WooCommerce
≤1.9.2Update to 1.9.3
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤10.0.05Update to 10.0.06
- Medium6.1Directory Plugin by Purethemes <= 2.0.21 - Reflected Cross-Site Scripting
Listeo-Core - Directory Plugin by Purethemes
≤2.0.21No patch available
- Medium6.1Reflected Cross-Site Scripting
XStore Core
≤5.6.4Update to 5.6.5
- Medium4.3Missing Authorization
The League - Sports News & Magazine WordPress Theme
≤4.4.1No patch available
- High8.1Unauthenticated Local File Inclusion
moments
≤2.2No patch available
- Medium5.3Missing Authorization
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<7.11.3Update to 7.11.3
- High8.8Authenticated (Author+) Local File Inclusion
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.0.4Update to 4.0.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Image Widget
≤4.4.11Update to 4.4.12
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤3.8.0Update to 3.9.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
Code Embed
≤2.5.1Update to 2.5.2