Database
WordPress Vulnerability Database (page 329)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Team – Team Members Showcase Plugin
≤5.0.13Update to 5.0.14
- Medium4.3Missing Authorization
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
≤5.0Update to 5.1
- Medium5.3Missing Authorization
Xpro Addons For Beaver Builder – Lite
≤1.5.6Update to 1.5.7
- Medium4.9Authenticated (Editor+) SQL Injection
UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
≤1.10.1Update to 1.11.0
- Critical9.8Unauthenticated Arbitrary File Upload
Wholesale Lead Capture Plugin for WooCommerce
≤2.0.3.1Update to 2.0.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Survey Maker by AYS
<5.1.7.7Update to 5.1.7.7
- Medium5.3Unauthenticated Information Exposure
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.2.8.3Update to 4.2.8.4
- High7.5Authenticated (Contributor+) Local File Inclusion
Boldman - Handyman Renovation Services WordPress Theme + RTL
≤7.7Update to 7.8
- Medium4.3Missing Authorization
Image Optimizer – Compress Images and Convert to WebP or AVIF
≤1.7.1Update to 1.7.2
- Medium5.3Missing Authorization
YMC Filter
≤3.5.1Update to 3.5.2
- Medium6.5Authenticated (Contributor+) SQL Injection
Media Library Assistant
≤3.32Update to 3.33
- Medium4.3Authenticated (Customer+) Race Condition
Wallet for WooCommerce
≤1.5.15Update to 1.5.16
- Medium5.3Missing Authorization
Pinpoint Booking System – Legacy version
≤2.9.9.6.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤2.1.1Update to 2.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Quiz Maker by AYS
≤6.7.1.7Update to 6.7.1.8
- Medium4.3Missing Authorization
smartfix
<1.2.4Update to 1.2.4
- Medium5.3Missing Authorization
iZooto – Web Push Notifications
≤3.7.20Update to 3.7.21
- Medium5.3Missing Authorization
ShipTime: Discount Shipping
≤1.1.4Update to 1.1.5
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Visual Link Preview
≤2.3.0Update to 2.3.1
- Medium5.3Missing Authorization
Video Conferencing with Zoom
<4.6.6Update to 4.6.6
- Medium4.9Authenticated (Editor+) SQL Injection
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤8.2.4Update to 8.2.5
- Medium5.3Missing Authorization
WP-Lister Lite for eBay
≤3.8.5Update to 3.8.6
- Medium4.3Missing Authorization
glb
≤1.2.2Update to 1.2.3
- High7.5Authenticated (Contributor+) Local File Inclusion
Emphires - Human Resources & Recruiting Theme
≤3.9No patch available
- Medium5.3Missing Authorization
Court Reservation – Tennis, Padel & Sports Court Booking
≤1.11.1Update to 1.12.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MK Google Directions
≤3.1.1No patch available
- Medium5.3Missing Authorization
Web Accessibility (formally known as Ally) – WCAG Scanning, Guided Fixes, Usability Widget
≤4.0.2Update to 4.0.3
- High7.5Authenticated (Contributor+) Local File Inclusion
Greenly - Ecology & Solar Energy WordPress Theme
≤8.1Update to 8.2
- Medium5.3Missing Authorization
Checkout for PayPal
≤1.0.46Update to 1.0.47
- Medium5.3Missing Authorization
Download Manager
≤3.3.52Update to 3.3.53