Database
WordPress Vulnerability Database (page 332)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤6.4.7Update to 6.4.8
- High7.5Authenticated (Contributor+) Local File Inclusion
Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager
≤1.2.9Update to 1.3.0
- Medium5.3Missing Authorization
Book Previewer for Woocommerce
≤1.0.6No patch available
- Medium5.3Missing Authorization
Leadrebel
≤1.0.2No patch available
- Medium5.3Unauthenticated Information Exposure
ShopBuilder – WooCommerce Builder For Elementor
≤3.2.4Update to 3.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤251005Update to 260101
- Medium5.3Missing Authorization
Digital Download
≤1.1.4Update to 1.1.5
- Medium5.3Missing Authentication to Unauthenticated Order Modification
Razorpay for WooCommerce
≤4.7.8Update to 4.7.9
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Korea SNS
≤1.7.0No patch available
- Medium4.3Missing Authorization
Envo Extra
≤1.9.13Update to 1.9.14
- Medium5.3Missing Authorization
Spa and Salon
≤1.3.2Update to 1.3.3
- Medium5.3Missing Authorization
Book Landing Page
≤1.2.7Update to 1.2.8
- Medium5.3Missing Authorization
Display Eventbrite Events
≤6.5.6Update to 6.5.7
- High8.1Unauthenticated PHP Object Injection
Grand Restaurant WordPress
≤7.0.10Update to 7.0.11
- Medium4.3Missing Authorization Authenticated (Subscriber+) Settings Update
Mesmerize Companion
≤1.6.158Update to 1.6.162
- Medium5.3Missing Authorization
Ridhi
≤1.1.2Update to 1.1.3
- High7.25.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update
BackWPup – WordPress Backup & Restore Plugin
5.0.0 – 5.6.2Update to 5.6.3
- High8.1Unauthenticated PHP Object Injection
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.1.1Update to 5.1.2
- Medium5.3Missing Authorization
Travel Diaries
≤1.2.4Update to 1.2.5
- Medium5.3Missing Authorization
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.19.4Update to 1.19.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Smartsupp – live chat, AI shopping assistant and chatbots
≤3.9.1Update to 3.9.2
- Medium5.3Missing Authorization
NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization
≤1.19.3Update to 1.19.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
Album and Image Gallery Plus Lightbox
≤2.1.7Update to 2.1.8
- High7.5Unauthenticated Time-Based SQL Injection
wpForo Forum
≤2.4.14Update to 2.4.15
- Medium6.5Unauthenticated Improper Handling of Missing Values
Simple Membership
≤4.7.0Update to 4.7.1
- Medium5.3Missing Authorization
Rara Academic
≤1.2.2Update to 1.2.3
- Medium5.3Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤4.4.2Update to 4.4.3
- Medium5.3Missing Authorization to Sensitive Information Exposure
Breadcrumb NavXT
≤7.5.0Update to 7.5.1
- Medium4.3Missing Authorization
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.7.6Update to 6.0.7.7
- Medium5.3Missing Authorization
Elegant Pink
≤1.3.3Update to 1.3.4