Database
WordPress Vulnerability Database (page 309)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
divi-booster
<5.0.2Update to 5.0.2
- Medium4.3Missing Authorization
W3 Total Cache
≤2.9.1Update to 2.9.2
- Medium6.1Reflected Cross-Site Scripting
Penci Soledad Data Migrator
≤1.3.1No patch available
- Medium5.3Missing Authorization
Revive.so – Bulk Rewrite and Republish Blog Posts
≤2.0.7Update to 2.0.8
- Medium4.9Authenticated (Editor+) SQL Injection
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.0.8.7Update to 1.0.9
- Medium5.3Missing Authorization
Timetics – Appointment Booking Calendar & Scheduling
<1.0.52Update to 1.0.52
- Medium5.3Unauthenticated Information Exposure
RSVP and Event Management
≤2.7.16Update to 2.7.17
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
Energox | EV Charging Station WordPress Theme
≤1.2Update to 1.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Comments – wpDiscuz
≤7.6.46Update to 7.6.47
- Medium5.3Unauthenticated Information Exposure
Guest posting / Frontend Posting / Front Editor – WP Front User Submit
<5.0.6Update to 5.0.6
- Medium4.3Authenticated (Contributor+) Information Exposure
Page Builder: Pagelayer – Drag and Drop website builder
≤2.0.8Update to 2.0.9
- High8.1Unauthenticated Local File Inclusion
BuilderPress - WordPress Theme for Construction, A
≤2.0.1No patch available
- Critical9.8Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.7.1Update to 6.0.7.2
- High7.2Authenticated (Editor+) Arbitrary File Upload
Mobile App Editor – WordPress to Android App Builder
≤1.3.1No patch available
- High7.5Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action
My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)
≤2.8.6Update to 2.8.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.2.8Update to 4.3.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
WpStream – Live Streaming, Video on Demand, Pay Per View
<4.11.2Update to 4.11.2
- Medium5.3Missing Authorization
Responsive Blocks – Page Builder for Blocks & Patterns
≤2.2.0Update to 2.2.1
- Medium5.3Missing Authorization
Advanced Product Fields (Product Addons) for WooCommerce
≤1.6.18Update to 1.6.19
- Medium4.3Missing Authorization
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.2.5Update to 0.1.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field
Checkout Field Editor (Checkout Manager) for WooCommerce
≤2.1.7Update to 2.1.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
Gravity Forms
≤2.9.28Update to 2.9.29
- High8.89.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
7.1.0 – 9.0.2Update to 9.0.3
- High8.89.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
8.0.0 – 9.0.2Update to 9.0.3
- High7.5Unauthenticated SQL Injection via 'append_where_sql' Parameter
Simply Schedule Appointments
≤1.6.9.27Update to 1.6.9.29
- Medium5.4Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.21.0Update to 3.21.1
- Medium6.4Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.21.0Update to 3.21.1
- High7.5Unauthenticated SQL Injection via 'check_in_date' Parameter
JetBooking
≤4.0.3Update to 4.0.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
Astra
≤4.12.3Update to 4.12.4
- High7.5Unauthenticated SQL Injection via 'location_id' Parameter
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.9.1Update to 4.9.2