Database
WordPress Vulnerability Database (page 35)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.3Update to 7.8.14.4
- Medium6.5Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute
VikRentCar Car Rental Management System
≤1.4.10Update to 1.4.11
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter
Related Posts for WordPress
≤3.0.0Update to 3.0.1
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.3Update to 7.8.14.4
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
Related Posts for WordPress
≤3.0.0Update to 3.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
Avada (Fusion) Builder
≤3.16.2Update to 3.16.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.27Update to 2.2.28
- Medium5.9Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More
≤1.31.0Update to 1.32.0
- Medium6.5Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute
WP Visitor Statistics (Real Time Traffic)
≤8.8Update to 8.9
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter
Product Addons for Woocommerce – Product Options with Custom Fields
≤3.1.8Update to 3.1.9
- Medium6.5Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
Rich Showcase for Google Reviews
≤7.1.6Update to 7.1.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
Waitlist Woocommerce ( Back in stock notifier )
≤2.9.1Update to 2.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.6Update to 2.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL
UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks
≤5.3.0Update to 5.4.0
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.6Update to 2.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤261011Update to 261017
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.2.4Update to 4.2.5
- Medium4.9Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment
Tainacan
≤1.3.0Update to 1.4.0
- High7.2Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.7.8Update to 5.7.9
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating
MxChat – AI Chatbot & Content Generation for WordPress
≤3.2.25Update to 3.2.26
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
Mang Board
≤2.4.5Update to 2.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.2Update to 1.10.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.2Update to 1.10.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
≤2.8.2Update to 2.8.3
- Medium4.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute
DesignSetGo
≤2.11.0Update to 2.11.1
- Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute
Document Embedder – let visitors read files without downloading
≤2.4.0Update to 2.4.1
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook
Clean Login
≤1.20.1Update to 1.21
- Medium4.8Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter
Customer Email Verification for WooCommerce – OTP Verification, Block Fake Signups
≤2.8.2Update to 2.8.3
- High7.5Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload
Product Designer for WooCommerce WordPress | Lumise
≤2.1.2No patch available
- Medium4.3Cross-Site Request Forgery
Newsletters
≤4.18.2No patch available