Database
WordPress Vulnerability Database (page 43)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
Newsletters
≤4.18.1Update to 4.18.2
- Medium6.1Reflected Cross-Site Scripting
We’re Open!
≤2.6Update to 2.7
- High7.5Unauthenticated SQL Injection
Newsletters
≤4.18.1Update to 4.18.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.26Update to 4.1.27
- Medium4.3Missing Authorization
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1
- Medium4.3Missing Authorization
Strong Testimonials
≤3.3.14Update to 3.3.15
- Medium5.3Missing Authorization
Falcon – Cache, Performance, Security, Cleanup, and Tweaks
≤2.12.0Update to 2.12.1
- Medium5.3Missing Authorization
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.2Update to 4.3.3
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.72Update to 2.1.80
- Medium4.3Cross-Site Request Forgery
Xpro Addons — 150+ Widgets for Elementor
≤1.7.10Update to 1.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Interactive Content – H5P
≤1.17.9Update to 1.17.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.14.4Update to 1.14.5
- Medium6.49.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
8.5.49 – 9.0.2Update to 9.0.3
- Medium5.3Missing Authorization
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Zoom API Credential Modification
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2
- High7.2Authenticated (Administrator+) Remote Code Execution
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium5.3Missing Authorization
Chikkili- Google Pay India for Woocommerce
≤1.0.6No patch available
- Medium4.33.7.54 - Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
3.7.13 – 3.7.54Update to 3.7.55
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<4.0.0Update to 4.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium5.3Unauthenticated Information Exposure
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium6.5Authenticated (Subscriber+) Arbitrary Media File Read
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium5.3Unauthenticated Information Exposure
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium6.1Reflected Cross-Site Scripting
Download Monitor
≤5.3.3Update to 5.3.4
- Medium4.7Authenticated (Admin+) Arbitrary File Write
JetBackup – Backup, Restore & Migrate
≤3.1.24.9Update to 3.1.24.10
- Medium5.3Two-Factor Authentication Bypass
asVereinbase – Club & Member Management for WP
≤1.1.7Update to 1.1.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels
≤2.2.2Update to 2.2.3
- Critical9.85.0.52 - Unauthenticated Arbitrary File Upload
YOOtheme Pro
5.0.0 – 5.0.52Update to 5.0.53