Database
WordPress Vulnerability Database (page 333)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
App Landing Page
≤1.2.2Update to 1.2.3
- High7.5Unauthenticated SQL Injection
Library Management System
≤3.2.1Update to 3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Easy Table of Contents
≤2.0.78Update to 2.0.79
- Medium4.3Missing Authorization
Image Photo Gallery Final Tiles Grid
≤3.6.10Update to 3.6.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode
Groups – Memberships and Access Control
≤3.10.0Update to 3.11.0
- Medium5.3Missing Authorization
Kalon
≤1.2.9Update to 1.3.0
- Medium5.3Missing Authorization
Pranayama Yoga
≤1.2.2Update to 1.2.3
- Medium5.3Missing Authorization
NM Gift Registry and Wishlist Lite
≤5.13Update to 5.14
- Medium5.3Missing Authorization
Influencer
≤1.1.7Update to 1.1.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) API Key Disclosure
Virusdie | One-click website security
≤1.1.7Update to 1.1.8
- Medium5.3Missing Authorization
Numinous
≤1.3.0Update to 1.3.1
- Medium4.3Missing Authorization
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.0Update to 3.9.1
- High7.5Authenticated (Contributor+) PHP Object Injection
Valenti
≤5.6.3.5No patch available
- High8.81.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
0.5.4 – 1.2.1Update to 1.2.2
- Medium5.3Missing Authorization
Aruba HiSpeed Cache
≤3.0.4Update to 3.0.5
- Medium5.3Unauthenticated Sensitive Information Exposure
Web Accessibility by accessiBe
≤2.11Update to 2.12
- Medium5.3Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
≤1.1.6Update to 1.1.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname
StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps
≤2.1.0Update to 2.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Advanced Custom Fields: Font Awesome Field
≤5.0.1Update to 5.0.2
- Medium5.35.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
4.0 – 5.10Update to 5.11
- Medium5.3Missing Authorization
The Minimal
≤1.2.9Update to 1.3.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Meta
Image Hotspot by DevVN
≤1.2.9Update to 1.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Hello Bar Popup Builder
≤1.5.1Update to 1.5.2
- Medium5.3Missing Authorization
Product Price by Formula for WooCommerce
≤2.5.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SEO Friendly Images
≤3.0.5No patch available
- High7.5Unauthenticated Time-Based SQL Injection via 'search' Parameter
Product Table & List Builder for WooCommerce
≤4.6.2Update to 4.6.3
- Medium6.5Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter
WP-DownloadManager
≤1.69Update to 1.69.1
- Medium5.3Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.6.9Update to 6.0.7.0
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
Blog2Social: Social Media Auto Post & Scheduler
≤8.7.4Update to 8.7.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Complianz GDPR/CCPA Cookie Consent Banner
≤7.4.3Update to 7.4.4