Database
WordPress Vulnerability Database (page 36)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Newsletters
≤4.18.2No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter
Appointment Booking Calendar
≤1.4.05Update to 1.4.06
- High7.5Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.2Update to 3.9.3
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute
Animated Text Block – Add Typing and Looping Text Effects
≤1.2.6Update to 1.2.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.7Update to 5.0.0
- Medium4.2Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.4Update to 3.8.5
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter
AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot
≤1.2.8Update to 1.2.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.7Update to 5.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
AMP for WP – Accelerated Mobile Pages
≤1.1.17Update to 1.1.18
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter
AI Alt Text Generator
≤2.7.0Update to 2.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.2Update to 3.9.3
- Critical9.8Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
Pie Register Premium
≤3.8.4.0Update to 3.8.4.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.14.0Update to 2.14.1
- Critical9.8Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
Jupiter X Core
≤4.61.0Update to 4.62.0
- Medium6.1Reflected Cross-Site Scripting
TableOn – WordPress Posts Table Filterable
≤1.0.7Update to 1.0.8
- High7.5Unauthenticated SQL Injection
Motors – Car Dealership & Classified Listings Plugin
≤1.4.126Update to 1.4.127
- Medium6.1Reflected Cross-Site Scripting
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.
≤3.1.7No patch available
- Medium6.1Reflected Cross-Site Scripting
OceanWP
≤4.2.7Update to 4.2.8
- Medium5.3Missing Authorization
GEO my WP
≤4.5.5.5Update to 4.5.5.7
- Medium4.3Missing Authorization
HANDMADE – Dropshipping for Etsy and WooCommerce
≤1.0.10Update to 1.0.11
- Medium5.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.11Update to 4.4.12
- Medium6.5Authenticated (Subscriber+) SQL Injection
BuddyPress
≤14.5.2Update to 14.5.3
- Medium4.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.9Update to 7.3.12
- Medium5.3Unauthenticated Information Exposure
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤4.1.0Update to 4.2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.5Update to 5.7.6
- Medium4.3Missing Authorization
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
≤2.1.3Update to 2.1.4
- High8.8Cross-Site Request Forgery via 'user_email' Parameter
Memberpress
≤1.14.1Update to 1.14.2
- High7.21.5.9 - Unauthenticated Stored Cross-Site Scripting
Community Events
1.4.9 – 1.5.9Update to 1.6.0
- Medium5.3Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- High8.8Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.276Update to 1.0.277