Database
WordPress Vulnerability Database (page 334)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20260113Update to 20260217
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values
Video Share VOD – Turnkey Video Site Builder Script
≤2.7.11Update to 2.7.12
- High7.5Unauthenticated SQL Injection via 'order' REST API Parameter
WPNakama – Editorial Workflow & Content Planning for WP
≤0.6.5Update to 0.6.6
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
SiteOrigin Widgets Bundle
≤1.70.4Update to 1.71.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter
Community Events
≤1.5.7Update to 1.5.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar
≤1.8.7Update to 1.9.0
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Listing Modification
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.20Update to 6.4.21
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.2.8.4Update to 4.2.8.5
- Low2.7Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter
WP-DownloadManager
≤1.69Update to 1.69.1
- Medium4.3Cross-Site Request Forgery to Arbitrary Pending Comment Deletion
Dam Spam
≤1.0.8Update to 1.0.9
- Medium5.3Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint
YayMail – WooCommerce Email Customizer
≤4.3.2Update to 4.3.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.8Update to 2.4.9
- Low2.7Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation
YayMail – WooCommerce Email Customizer
≤4.3.2Update to 4.3.3
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
YayMail – WooCommerce Email Customizer
≤4.3.2Update to 4.3.3
- High7.2Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action
YayMail – WooCommerce Email Customizer
≤4.3.2Update to 4.3.3
- High7.2Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter
Product Addons for Woocommerce – Product Options with Custom Fields
≤3.1.0Update to 3.1.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting
Private Comment
≤0.0.4Update to 0.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
InteractiveCalculator for WordPress
≤1.0.3Update to 1.0.4
- High7.2Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting
CartSuite – Cart All In One For WooCommerce
≤1.1.21Update to 1.1.22
- Medium6.1Reflected Cross-Site Scripting via 'redirect_to' Parameter
Download Manager
≤3.3.46Update to 3.3.47
- Medium4.3Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.6.1Update to 3.6.2
- Medium4.3Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.6.1Update to 3.6.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤5.0.2Update to 5.0.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤5.0.2Update to 5.0.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification
PDF Invoices & Packing Slips for WooCommerce
≤5.6.0Update to 5.7.0
- Medium4.3Cross-Site Request Forgery to Settings Update
Keybase.io Verification
≤1.4.5Update to 1.4.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings
Membership Plugin – Kadence Memberships
≤3.2.18Update to 3.2.19
- Medium4.3Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation
WP Plugin Info Card – Showcase Beautiful Plugin Cards, Theme Cards, and GitHub Repos Anywhere
≤6.2.0Update to 6.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title
VK All in One Expansion Unit
≤9.112.3Update to 9.112.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update
Tickera – Sell Tickets & Manage Events
≤3.5.6.4Update to 3.5.6.5