Database
WordPress Vulnerability Database (page 33)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Contributor+) Information Exposure
Page Builder by SiteOrigin
<2.38.0Update to 2.38.0
- Medium5.8Unauthenticated CSV Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium5.3Missing Authorization to Unauthenticated Information Exposure
PiWeb Disable payment method / Partial payment for WooCommerce
<1.1.10.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Firelight Lightbox
≤2.3.22Update to 2.3.23
- Medium4.3Missing Authorization
BuddyForms
≤2.10.0Update to 2.10.1
- Medium5.3Unauthenticated Information Exposure
BuddyForms
≤2.10.2Update to 2.10.3
- Medium4.3Missing Authorization
Fraud Prevention For WooCommerce and EDD
≤2.3.5Update to 2.3.6
- Medium6.46.4.1 - Authenticated (Author+) Stored Cross-Site Scripting
Joinchat – Enhanced “click to chat”
6.3.2 – 6.4.1Update to 6.4.2
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Visitor Statistics (Real Time Traffic)
≤8.7Update to 8.8
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Visitor Statistics (Real Time Traffic)
≤8.7Update to 8.8
- Medium4.3Missing Authorization
My auctions allegro
≤4.0.3Update to 4.0.4
- Medium6.53.6.3 - Authenticated (Contributor+) SQL Injection
Recipe Card Blocks Lite
3.5.0 – 3.6.3Update to 3.6.4
- Medium6.1Reflected Cross-Site Scripting
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.13Update to 4.3.14
- High7.2Unauthenticated Server-Side Request Forgery
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<2.0.2Update to 2.0.2
- Medium4.9Authenticated (Administrator+) SQL Injection
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<2.0.2Update to 2.0.2
- High7.2Authenticated (Administrator+) Remote Code Execution
Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation
<2.0.2Update to 2.0.2
- Low2.7Authenticated (Administrator+) Information Exposure
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.190Update to 2.191
- High8.14.2.2 - Unauthenticated PHP Object Injection
Enable Media Replace
4.1.4 – 4.2.2Update to 4.2.3
- Medium5.33.1.0 - Missing Authorization
PayPlug for WooCommerce (Official)
2.8.0 – 3.1.0Update to 3.1.1
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
<2.8.195Update to 2.8.195
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
<2.8.196Update to 2.8.196
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
<2.8.196Update to 2.8.196
- Medium4.3Cross-Site Request Forgery
Media Library Assistant
<3.42Update to 3.42
- Medium6.45.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
5.9 – 5.15Update to 5.16
- Medium4.3Missing Authorization
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP
<1.5.10Update to 1.5.10
- Medium4.31.5.9 - Missing Authorization
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP
1.4.38 – 1.5.9Update to 1.5.10
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
GoSMTP – SMTP for WordPress
<1.2.5Update to 1.2.5
- Medium4.3Missing Authorization
Welcart e-Commerce
<2.12.6Update to 2.12.6
- Medium4.9Authenticated (Editor+) SQL Injection
Welcart e-Commerce
<2.12.6Update to 2.12.6
- Medium6.17.3.1 - Reflected Cross-Site Scripting
افزونه پیامک ووکامرس | Persian WooCommerce SMS
7.2.0 – 7.3.1Update to 7.3.2