Database
WordPress Vulnerability Database (page 38)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.7Update to 1.3.8
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Booking for Appointments and Events Calendar – Amelia
≤2.4.12Update to 2.4.13
- High7.2Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title
Analytics Insights – Google Analytics Dashboard for WordPress
≤6.3.12Update to 6.4
- High8.1Unauthenticated PHP Object Injection
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.1Update to 2.14.0
- High7.5Authenticated (Author+) PHP Object Injection
Filter Everything — WordPress & WooCommerce Filters
≤1.9.7Update to 1.9.8
- High7.5Authenticated (Contributor+) PHP Object Injection
Phoenix Media Rename
≤3.13.5Update to 3.13.6
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.1Update to 5.3.2
- High7.5Authenticated (Contributor+) PHP Object Injection
Logo Slider – Logo Carousel, Logo Showcase, Logo Gallery & Client Logos
≤3.8.9Update to 3.9.0
- Medium6.6Authenticated (Editor+) PHP Object Injection
Accordions
≤2.3.25No patch available
- High8.1Unauthenticated PHP Object Injection
Zoho Flow – No-Code Workflow Automation
≤2.14.5Update to 2.14.6
- Medium5.3Missing Authorization
Optima Express IDX
≤9.0.1No patch available
- Medium4.3Missing Authorization
Redux Framework
≤4.5.16Update to 4.5.17
- Medium6.5Authenticated (Subscriber+) SQL Injection
BuddyPress
≤14.5.2Update to 14.5.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliate Program Suite — SliceWP Affiliates
≤1.2.13Update to 1.2.14
- Medium5.3Unauthenticated Information Exposure
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.10.5Update to 1.10.7
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.24Update to 2.0.25
- High7.5Unauthenticated SQL Injection
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤3.8.5.2Update to 3.8.6
- Medium6.1Reflected Cross-Site Scripting
eCommerce Product Catalog
≤3.6.4Update to 3.6.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Discussion Board – WordPress Forum Plugin
≤2.6.0Update to 2.6.1
- High7.5Unauthenticated SQL Injection
DXP ToolKit
≤2.0.1Update to 2.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
DXP ToolKit
≤2.0.1Update to 2.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.62Update to 2.8.63
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetSmartFilters
≤3.8.6.1Update to 3.8.6.2
- Medium4.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.5Update to 4.7.6
- Medium5.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.5Update to 4.7.6
- Medium5.3Missing Authorization
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.10.7Update to 1.11.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Panorama – Turn Photos into Immersive Virtual Tours
≤1.8.3Update to 1.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
bSlider – Build Sliders That Bring Your Content to Life
≤2.2.2Update to 2.2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.5Update to 2.9.2.6