Database
WordPress Vulnerability Database (page 308)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Authenticated (Shop manager+) SQL Injection
UpsellWP – Upsell and Related Products Offers for WooCommerce
≤2.2.4Update to 2.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultra Addons for Contact Form 7
≤3.5.36Update to 3.5.37
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
≤6.19.8Update to 6.19.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Categories Images
≤3.3.1Update to 3.3.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.1.9Update to 9.1.10
- Medium5.3Missing Authorization
Subscriptions for WooCommerce
≤1.8.10Update to 1.9.0
- Low3.7Unauthenticated Information Exposure
DOOFINDER Search and Discovery for WP & WooCommerce
≤2.10.13Update to 2.10.14
- High8.8Authenticated (Subscriber+) Privilege Escalation
Search & Go - Directory WordPress Theme
≤2.8Update to 2.8.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation
WPZOOM Connect: Social Icons Widget & Block, Share Buttons & Click to Chat
≤4.5.8Update to 4.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.4.5.0Update to 5.4.5.1
- Medium6.4Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API
GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO
≤4.3.2Update to 4.3.3
- Medium5.4Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion
GetGenie – AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO
≤4.3.2Update to 4.3.3
- Medium5.3Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.28Update to 6.29
- High7.5Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.28Update to 6.29
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint
Simply Schedule Appointments
≤1.6.9.29Update to 1.6.10.0
- Medium4.3Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure
Simply Schedule Appointments
≤1.6.9.29Update to 1.6.10.0
- Critical9.8Unauthenticated Arbitrary File Upload
Pix for WooCommerce
≤1.5.0Update to 1.6.0
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'c'
Simple Ajax Chat – Add a Fast, Secure Chat Box
≤20260217Update to 20260301
- High7.2Unauthenticated Stored Cross-Site Scripting
DukaPress
≤3.2.4No patch available
- High7.2Authenticated (Editor+) Remote Code Execution
Spam Protect for Contact Form 7
<1.2.10Update to 1.2.10
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Reading progressbar
<1.3.1Update to 1.3.1
- Medium5.3Unauthenticated Privilege Escalation
Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility
≤7.1.0.30Update to 7.1.0.31
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
Instant VA - Virtual Assistant Elementor Template Kit
≤1.0.1Update to 1.0.2
- Medium5.3Missing Authorization
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.7Update to 3.0.8
- Medium5.3Missing Authorization
MetForm Pro
≤3.9.8Update to 3.9.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Everest Forms Pro
≤1.9.12Update to 1.9.13
- Critical9.8Unauthenticated Privilege Escalation
Datalogics Ecommerce Delivery – Datalogics
<2.6.60Update to 2.6.60
- Medium6.1Reflected Cross-Site Scripting
Website LLMs.txt
≤8.2.6Update to 8.2.7
- Critical9.8City Travel Guide WordPress Theme <= 1.7.0 - Unauthenticated Privilege Escalation
Golo - City Travel Guide WordPress Theme
≤1.7.0No patch available
- Medium4.3Missing Authorization to Authenticated (Contributor+) Settings Update
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
<1.6.1Update to 1.6.1