Database
WordPress Vulnerability Database (page 32)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
Schema App Structured Data
≤2.3.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
DSGVO All in one for WP
≤5.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
Food Store – Online Food Delivery & Pickup
≤1.5.5No patch available
- High7.5Unauthenticated SQL Injection via 'subscriberid' Parameter
SendPress Newsletters
≤1.26.1.20No patch available
- High7.5Unauthenticated SQL Injection via 'exclude_posts' Parameter
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- Critical9.8Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
Bot for Telegram on WooCommerce
≤1.3.0No patch available
- High8.1Unauthenticated Authentication Bypass to Account Takeover
SSL Wireless SMS Notification
≤3.8.1No patch available
- High7.5Authentication Bypass via SSO Email-Collision Account Binding on Multisite
Wild Apricot Login
≤1.0.18No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Dynamic QR Code
≤1.0.1No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
myPOS Checkout
≤1.4.5No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
News Kit Addons For Elementor
≤1.5.0No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Finale Lite – Sales Countdown Timer & Discount for WooCommerce
≤2.21.0No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
WP Media folders
≤1.1.10No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Frisbii Pay
≤1.8.19Update to 1.8.20
- High7.5Authenticated (Author+) PHP Object Injection
Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor
≤1.2.3No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Product Catalog Feed by PixelYourSite
≤3.1.4No patch available
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
FV Flowplayer Video Player
≤7.5.56.7212Update to 7.5.57.7212
- High7.5Authenticated (Contributor+) PHP Object Injection
Social Snap — Social Share Buttons & Click to Tweet
≤1.5.4No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
10WebSocial
≤1.5.6No patch available
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Hotel Booking
≤3.8No patch available
- Medium5.3Unauthenticated Information Exposure
WP Crowdfunding
≤2.2.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
GlobalPayments Gateway Provider for WooCommerce
≤1.23.3No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
BuddyPress Xprofile Custom Field Types
≤1.3.1No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Extra Fees for WooCommerce
≤4.4.0No patch available
- High7.5Authenticated (Author+) PHP Object Injection
WPCargo Track & Trace
≤8.0.5No patch available
- Medium6.6Authenticated (Editor+) PHP Object Injection
Zippy
≤1.7.0No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation
BuddyBoss Platform
≤3.5.0Update to 3.6.1
- High8.1Unauthenticated Authentication Bypass
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.190Update to 2.191
- Medium5.3Missing Authorization
Bricks Builder
≤2.4.3Update to 2.4.4
- Medium5.3Missing Authorization
Court Reservation – Tennis, Padel & Sports Court Booking
<1.12.4Update to 1.12.4