Database
WordPress Vulnerability Database (page 37)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) Account Takeover
OTP Login With Phone Number, OTP Verification
≤1.8.78Update to 1.8.79
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.1Update to 4.0.2
- Medium4.3Authenticated (Author+) Insecure Direct Object Reference
Photo Engine (Media Organizer & Lightroom)
≤6.5.0Update to 6.6.0
- Critical9.8Unauthenticated Arbitrary File Upload
Chat AI with Dispatcher
≤2.3Update to 2.4
- Medium5.3Unauthenticated Information Exposure
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.196Update to 2.8.197
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
Automated Import Products to Cart
≤1.0.3Update to 1.0.4
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
LogixFast Auth
≤1.0.3Update to 1.0.4
- Medium5.3Unauthenticated Payment Bypass
MembershipWorks – Membership, Events & Directory
≤6.16Update to 6.17
- Medium4.3Authenticated (Subscriber+) Two-Factor Authentication Bypass
All-In-One Security (AIOS) – Security and Firewall
≤5.4.0Update to 5.5.0
- Medium4.3Cross-Site Request Forgery
WP Photo Album Plus
≤9.3.04.3Update to 9.3.04.004
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Enable SVG, WebP, and ICO Upload
≤1.1.5Update to 1.1.6
- Medium6.41.1.5 - Authenticated (Author+) Stored Cross-Site Scripting
Enable SVG, WebP, and ICO Upload
1.1.3 – 1.1.5Update to 1.1.6
- Medium5.3Missing Authorization
Hide Price Until Login
≤1.1.1Update to 1.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.27Update to 2.2.28
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
≤2.8.1Update to 2.8.2
- Medium5.3Missing Authorization
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤4.1.0Update to 4.2.0
- High8.1Unauthenticated PHP Object Injection
ProfileGrid – User Profiles, Groups and Communities
≤6.0.0.4Update to 6.0.0.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
LetterPress – Email Marketing, SMTP, Newsletter & Multi-Brand Subscriber Manager
≤2.3.0Update to 2.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode
≤3.9.6Update to 3.9.7
- Medium4.8Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
Advanced Custom Fields: Extended
≤0.9.2.6Update to 0.9.2.7
- Critical9.8Authentication Bypass via Social Login
Qode Membership
≤2.0.6.2Update to 2.0.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter
Jupiter X Core
≤4.61.0Update to 4.62.0
- High8.8Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.5Update to 6.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.7Update to 1.3.8
- Medium4.3Missing Authorization
Customer Coupons for WooCommerce
≤1.3.14Update to 1.3.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Button Block – Stylish buttons that get more clicks
≤1.2.7Update to 1.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Text Typing – grab attention with animated typing headlines
≤2.2.0Update to 2.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Content Slider Block – Bring your content to life with slides
≤3.2.1Update to 3.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All In One Lightbox – show any media in beautiful popups
≤1.2.0Update to 1.2.1
- Medium5.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.11Update to 4.4.12