Database
WordPress Vulnerability Database (page 40)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) SQL Injection
Advanced Ads – Tracking
<4.0.0Update to 4.0.0
- Medium5.3Unauthenticated Arbitrary Email Header Injection
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium5.3Missing Authorization
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- High7.2Authenticated (Administrator+) Remote Code Execution
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium4.3Cross-Site Request Forgery
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium4.3Cross-Site Request Forgery
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium5.33.6.3 - Unauthenticated Information Exposure
Recipe Card Blocks Lite
2.6.4 – 3.6.3Update to 3.6.4
- Medium5.3Missing Authorization to Unauthenticated Roster Member Deletion
WP Roster
<2.35Update to 2.35
- Medium4.3Cross-Site Request Forgery
Media Library Assistant
<3.42Update to 3.42
- Medium4.7Unauthenticated Open Redirect
Welcart e-Commerce
<2.12.6Update to 2.12.6
- Medium5.3Unauthenticated Login URL Settings Modification
WPOrLogin – Custom Login, Social Login, CAPTCHA & Security
<3.1.0Update to 3.1.0
- High7.36.8.6 - Unauthenticated Registration Approval Bypass
Essential Addons for Elementor – Popular Elementor Templates & Widgets
6.7.3 – 6.8.6Update to 6.8.7
- Medium5.3Unauthenticated Unauthorized Email Relay
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1070Update to 1.7.1070
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng
<4.2.0Update to 4.2.0
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
UniPAY Payment Gateway For WooCommerce
≤2.3Update to 2.4
- Medium5.3Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Confirmation
Sadad QA Payment
≤1.28Update to 1.29
- Medium5.3Unauthenticated Payment Bypass
BitPay Gateway for WooCommerce
≤4.1.3No patch available
- Medium5.31.2.1 - Unauthenticated Order Payment Forgery
TiendaCrypto para WooCommerce
1.0.1 – 1.2.1No patch available
- Medium5.3Unauthenticated Payment Bypass
PAYDUNYA WOOCOMMERCE PAR
≤1.1.6No patch available
- Medium5.3Unauthenticated Payment Bypass
Payex Payment Gateway for Woocommerce
≤1.2.10No patch available
- Medium5.3Unauthenticated Payment Bypass
Payment Integration Wompi
≤4.0.1No patch available
- High8.8Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
≤2.17.0Update to 2.18.0
- Medium5.3Missing Authorization
Mintpay for WooCommerce
≤2.2.3No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Advanced Custom Fields: Extended
0.9.2.7 – 0.9.2.7Update to 0.9.2.8
- Critical9.8Unauthenticated Remote Code Execution
Advanced Custom Fields: Extended
<0.9.2.8Update to 0.9.2.8
- Medium6.40.9.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Advanced Custom Fields: Extended
0.8.9.4 – 0.9.2.7Update to 0.9.2.8
- High7.3Unauthenticated Arbitrary Non-Admin Account Takeover
Advanced Custom Fields: Extended
0.9.2.7 – 0.9.2.7Update to 0.9.2.8
- Medium4.3Missing Authorization
LiteSpeed Cache
<7.9.2Update to 7.9.2
- High7.2Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.5.17Update to 5.0.0
- High7.3Unauthenticated Privilege Escalation
Datawiza Proxy Auth Plugin – SSO
≤1.1.0Update to 1.1.1