Database
WordPress Vulnerability Database (page 338)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Rich Showcase for Google Reviews
≤6.9.4.3Update to 6.9.4.4
- Medium5.3Missing Authorization
UnitechPay – Wave & Orange Money Payments
≤1.0.2No patch available
- Medium5.3Missing Authorization
Sprout Invoices – Client Invoicing & Estimates
≤20.8.8Update to 20.8.9
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Simple HTML Sitemap
≤3.8Update to 3.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Icon List Block – Add Icon-Based Lists with Custom Styles
≤1.2.3Update to 1.2.4
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.3.17Update to 8.3.18
- High8.8Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access
Ecwid by Lightspeed Ecommerce Shopping Cart
≤7.0.7Update to 7.0.8
- Critical9.8Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation
Anti-Spam, Spam FireWall by CleanTalk
≤6.71Update to 6.72
- Medium4.3Cross-Site Request Forgery
Theme Editor
≤3.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.1.2Update to 5.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Activity Log
≤5.5.4Update to 5.6.0
- Medium4.3Cross-Site Request Forgery
ApusListing - Directory Listing WordPress Theme
≤1.2.63Update to 1.2.64
- Medium4.3Cross-Site Request Forgery
Blackfyre - Create Your Own Gaming Community
≤2.5.4No patch available
- Medium4.3Unauthenticated Information Exposure
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
<5.1.9Update to 5.1.9
- Medium5.3Missing Authorization
WP Ultimate Review
≤2.3.9Update to 2.4.0
- Medium5.3Missing Authorization
Payment Plugins for PayPal WooCommerce
≤2.0.13Update to 2.0.14
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Qubely – Advanced Gutenberg Blocks
≤1.8.14No patch available
- Medium5.3Missing Authorization
Alt Text AI – Automatically generate image alt text for SEO and accessibility
≤1.10.15Update to 1.10.18
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Simple Blog Card
≤2.37Update to 2.38
- Medium4.9Authenticated (Editor+) SQL Injection
Booking Calendar
≤10.14.15Update to 10.14.16
- High7.5Authenticated (Contributor+) PHP Object Injection
JetEngine
<3.8.4.1Update to 3.8.4.1
- Medium4.3Missing Authorization
RPS Include Content
≤1.2.2No patch available
- Medium4.3Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename
Media Library Folders
≤8.3.6Update to 8.3.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.5.9Update to 6.5.10
- Medium5.05.10 - Authenticated (Author+) Server-Side Request Forgery
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
5.3 – 5.10Update to 5.11
- Critical9.8Unauthenticated Privilege Escalation via Registration
Truelysell Core
≤1.8.7Update to 1.8.8
- Medium4.9Authenticated (Administrator+) SQL Injection via Multiple API Endpoints
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.19.2Update to 1.19.3
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing
Modula Image Gallery – Photo Grid & Video Gallery
≤2.13.6Update to 2.13.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Activity Log
Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals
≤5.2.2Update to 5.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤2.9.7.3Update to 2.9.7.4