Database
WordPress Vulnerability Database (page 39)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Contributor+) Information Exposure
Media Library Assistant
≤3.42Update to 3.43
- Medium4.3Missing Authorization
Geo Mashup
≤1.13.22Update to 1.13.23
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Geo Mashup
≤1.13.22Update to 1.13.23
- Medium6.5Authenticated (Contributor+) SQL Injection
JetEngine
≤3.9.0Update to 3.9.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Lazy Load for Videos
≤2.18.11Update to 2.18.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Better Post & Filter Widgets for Elementor
≤1.9.1Update to 1.9.2
- Medium6.5Authenticated (Author+) SQL Injection
Media Library Assistant
≤3.42Update to 3.43
- Medium4.3Missing Authorization
Better Post & Filter Widgets for Elementor
≤1.9.1Update to 1.9.2
- Medium6.1Reflected Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium5.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.8.2Update to 2.8.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1069Update to 1.7.1070
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1069Update to 1.7.1070
- Medium4.3Cross-Site Request Forgery
Media Library Assistant
≤3.42Update to 3.43
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1069Update to 1.7.1070
- Medium5.3Missing Authorization
Bopo – WooCommerce Product Bundle Builder
≤1.2.3Update to 1.2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.8.0.1Update to 3.8.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Gallery Block – Showcase Photos in Stunning Responsive Grids
≤2.4.1Update to 2.4.2
- Medium5.3Missing Authorization
Discussion Board – WordPress Forum Plugin
≤2.6.0Update to 2.6.1
- Medium4.3Cross-Site Request Forgery
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤3.8.5.2Update to 3.8.6
- Medium4.3Missing Authorization
DEPART – Deposit and Part payment for Woo
≤1.0.10Update to 1.1.0
- Medium4.3Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.6Update to 3.8.7
- Medium5.3Missing Authorization
Link Library
≤7.9.0Update to 7.10.0
- High7.5Unauthenticated SQL Injection
vTables – Data Table Builder for CSV, Excel & JSON
≤0.2Update to 0.3
- Medium5.35.45 - Unauthenticated Payment Bypass
PAYCOMET for WooCommerce
5.36 – 5.45Update to 5.46
- Medium5.3Unauthenticated Information Exposure
Link Library
≤7.9.0Update to 7.10.0
- Medium5.3Unauthenticated Discount Code Limit Bypass
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.1Update to 3.7.2
- Medium4.7Unauthenticated HTML Injection
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.7.9Update to 5.7.10
- Medium5.4Authenticated (Contributor+) Cross-Site Scripting
Advanced Post Block – Display Your Posts Exactly How You Want
≤2.5.1Update to 2.5.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Advanced Ads – Tracking
<4.0.0Update to 4.0.0
- Medium5.3Unauthenticated Arbitrary Email Header Injection
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1