Database
WordPress Vulnerability Database (page 42)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Payment Bypass
Online Payments with iK Pay Gateway
≤3.0.3Update to 3.0.4
- Medium5.3Unauthenticated Order Payment Forgery
Eurobank WooCommerce Payment Gateway
<2.1.2Update to 2.1.2
- Critical9.8Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
Prime Mover – Backup and Migration
≤2.2.1Update to 2.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter
Anti-Spam, Spam FireWall by CleanTalk
≤6.89.1Update to 6.90
- Medium5.3Missing Authorization
UPI QR Code Payment Gateway for WooCommerce
≤1.6.3Update to 1.7.0
- Medium6.6Authenticated (Editor+) PHP Object Injection
Relevanssi – A Better Search
≤4.28.4Update to 4.28.5
- Medium5.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.7.8Update to 5.7.9
- Medium5.3Missing Authorization
Social Feed Gallery
≤5.0.13No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Extensions for Leaflet Map
≤6.0Update to 6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ND Shortcodes
≤7.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Waitlist Woocommerce ( Back in stock notifier )
≤2.9.1Update to 2.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Restaurant Menu – Food Ordering System – Table Reservation
≤2.4.4No patch available
- Medium5.3Missing Authorization
ЮKassa для WooCommerce
≤2.17.3Update to 2.17.4
- Medium5.3Unauthenticated Information Exposure
ShopMagic – email automation for WordPress
≤4.9.1Update to 4.9.2
- Medium6.1Reflected Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium5.3Missing Authorization
Page and Post Restriction
≤1.6.0Update to 1.6.1
- Medium5.3Missing Authorization
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.1Update to 1.2.2
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.7.5Update to 3.8
- High8.1Unauthenticated PHP Object Injection
Paytium: Mollie payment forms & donations
≤5.0.5Update to 5.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
VOD Infomaniak
≤1.5.14Update to 1.5.15
- Medium6.1Reflected Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.8Update to 7.4.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.7Update to 5.0.0
- Medium4.3Missing Authorization
SureDash – Community, Courses & Member Dashboard
≤1.12.2Update to 1.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
QA Assistants – Driven by data
≤5.3.0.1Update to 5.3.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
W3 Total Cache
≤2.10.7Update to 2.11.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Off-Canvas Sidebars & Menus (Slidebars)
≤0.5.9Update to 0.5.9.1
- Medium5.3Missing Authorization
SureDash – Community, Courses & Member Dashboard
≤1.12.2Update to 1.12.3
- Medium5.3Missing Authorization
SureDash – Community, Courses & Member Dashboard
≤1.12.2Update to 1.12.3
- Medium5.3Unauthenticated Information Exposure
LiteSpeed Cache
≤7.9Update to 7.9.1
- High7.5Unauthenticated SQL Injection
Product Filter for WooCommerce by WBW
≤3.4.6Update to 3.4.7