Database
WordPress Vulnerability Database (page 31)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Firelight Lightbox
≤2.3.23Update to 2.3.24
- Medium5.32.10.0 - Unauthenticated Arbitrary Guest Attachment Deletion
BuddyForms
2.8.8 – 2.10.0Update to 2.10.1
- Medium4.3Two-Factor Authentication via Brute Force
Security Optimizer – The All-In-One Protection Plugin
≤1.6.8Update to 1.6.9
- Medium5.3Missing Authorization
Premium Packages – Sell Digital Products Securely
≤7.2.1Update to 7.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.42Update to 3.43
- Medium6.5Authenticated (Author+) Path Traversal
Bulk Media Register
≤2.0Update to 2.01
- Medium4.7SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 -Unauthenticated Arbitrary HTML Injection
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.9Update to 2.13.0
- High7.25.16.4 - Unauthenticated Stored Cross-Site Scripting
PDF Invoices & Packing Slips For WooCommerce
5.16.2 – 5.16.4Update to 5.16.5
- Medium6.36.8.7 - Authenticated (Author+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
6.6.0 – 6.8.7Update to 6.8.8
- Medium4.3Authenticated (Contributor+) Information Exposure
Payment Forms for Paystack
≤4.0.5Update to 4.0.6
- Medium5.32.4.5 - Unauthenticated Payment Bypass
PayHere Payment Gateway
2.4.0 – 2.4.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters
NewsmanApp
≤3.7.29Update to 3.7.32
- Medium5.3Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
MW WP Form
≤5.1.7Update to 5.1.8
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
Meta Box – A Framework for Dynamic Websites
≤5.15.2Update to 5.15.3
- High7.5Unauthenticated SQL Injection via 'slug' Parameter
Newsmatic
≤1.5.0Update to 1.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Content-Type Header
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.2Update to 9.3.3
- Medium4.7Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
Media Library Assistant
≤3.42Update to 3.43
- High7.2Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter
Mapster WP Maps
≤2.0.5Update to 2.0.6
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization
LiteSpeed Cache
≤7.9.1Update to 7.9.2
- Medium5.4Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
LiteSpeed Cache
≤7.9.1Update to 7.9.2
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText
Greenshift – animation and page builder blocks
≤13.2.1Update to 13.2.2
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block
Greenshift – animation and page builder blocks
≤13.2.1Update to 13.2.2
- Medium4.7Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.12Update to 5.2.13
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property
Extensions for Leaflet Map
≤5.4Update to 6.0
- Medium6.1Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- Medium5.3Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- Medium6.5Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.7.11Update to 5.7.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys
Sequential Order Numbers for WooCommerce
≤3.6.5Update to 3.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler
Password Protected
≤2.8.4Update to 2.8.5