Database
WordPress Vulnerability Database (page 331)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute
Advance Block Extend
≤1.0.4No patch available
- High8.8Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions
Toret Manager
≤1.2.7Update to 1.3.0
- Critical9.8Unauthenticated Local File Inclusion via parameters[template_name]
Prodigy Commerce
≤3.3.0Update to 3.3.1
- Medium4.3Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action
Whatsiplus Scheduled Notification for Woocommerce
≤1.0.1No patch available
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change
Mega Store Woocommerce
≤6.4.2No patch available
- Critical9.8Unauthenticated Privilege Escalation
Lizza LMS Pro
≤1.0.3Update to 1.0.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
PostmarkApp Email Integrator
≤2.4Update to 2.5.0
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
Orderable – Restaurant & Food Ordering System
≤1.20.0Update to 1.20.1
- Medium5.3Missing Authorization to Cache Deletion
Breeze Cache
≤2.2.21Update to 2.2.22
- Critical9.8Unauthenticated Privilege Escalation via User Registration
Buyent
≤1.0.7No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Country Blocker for AdSense
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery to Arbitrary Page Title Modification
Page Title, Description & Open Graph Updater
≤1.02No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via a13_alt_link Parameter
Apollo13 Framework Extensions
≤1.9.8Update to 1.9.9
- Medium6.5Two-Factor Authentication Bypass via token
Two Factor (2FA) Authentication via Email
≤1.9.8Update to 1.9.9
- High8.8Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation
WP AUDIO GALLERY
≤2.0No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
Shopire
≤1.0.57Update to 1.0.58
- High7.2Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤6.6.11Update to 6.6.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Renden
≤1.9.0No patch available
- Medium5.3Unauthenticated Limited File Upload
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.8.1Update to 7.8.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Ad Placements Update
Advanced Ads – Ad Manager & AdSense
≤2.0.14Update to 2.0.15
- Critical9.8Unauthenticated Privilege Escalation
Clasifico Listing
≤2.0No patch available
- High8.80.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation
NewsBlogger
0.2.5.6 – 0.2.5.9Update to 0.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Drift
≤1.6.0No patch available
- Medium4.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Easy SVG Support
≤4.0Update to 4.1
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Printful Integration for WooCommerce
≤2.2.11Update to 2.2.12
- Medium6.5Missing Authorization to Unauthenticated Plugin's Settings Modification
Aruba HiSpeed Cache
≤3.0.2Update to 3.0.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modification
ACF Photo Gallery Field
≤3.0Update to 3.1
- Medium4.3Cross-Site Request Forgery to Mailchimp List Change
Mailchimp List Subscribe Form
≤2.0.0Update to 2.0.1
- Medium6.1Reflected Cross-Site Scripting
Aruba HiSpeed Cache
≤3.0.2Update to 3.0.3
- High7.5Missing Authorization to Sensitive Information Exposure
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.1.2Update to 4.1.3