Database
WordPress Vulnerability Database (page 46)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Contributor+) Remote Code Execution
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1068Update to 1.7.1069
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- Medium6.3Authenticated (Author+) Privilege Escalation
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.4Update to 4.0.5
- High7.5Unauthenticated SQL Injection
Booking for Appointments and Events Calendar – Amelia
≤2.4.11Update to 2.4.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form Email
≤1.3.68Update to 1.3.69
- High8.8Authenticated (hipaa_forms+) Privilege Escalation
HIPAA Forms
≤3.3.1Update to 3.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WebP Express
≤0.25.15Update to 0.25.16
- Medium4.32.3.2 - Authenticated (Author+) Arbitrary Email Header Injection
Subscribe to Comments
2.3 – 2.3.2Update to 2.3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Link Library
≤7.9.5Update to 7.9.6
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium6.1WordPress Event & Booking Manager Plugin <= 0.1.1 - Reflected Cross-Site Scripting
Eventer
≤0.1.1No patch available
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.4.10No patch available
- High8.1Unauthenticated Local File Inclusion
Academist Core
≤1.4.1No patch available
- Medium5.3Missing Authorization
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- Critical9.1Unauthenticated Arbitrary File Deletion
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- Medium5.3Missing Authorization
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6
- Medium4.3Authenticated (Author+) Insecure Direct Object Reference
Photo Engine (Media Organizer & Lightroom)
≤6.5.7Update to 6.5.8
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Photo Engine (Media Organizer & Lightroom)
≤6.5.7Update to 6.5.8
- High7.5Authentication Bypass
Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP
<1.5.7Update to 1.5.7
- Medium4.32.12.2 - Missing Authorization
MB Custom Post Types & Custom Taxonomies
2.4.0 – 2.12.2Update to 2.12.3
- Medium5.32.12.2 - Missing Authorization
MB Custom Post Types & Custom Taxonomies
2.0.2 – 2.12.2Update to 2.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
PixelYourSite Pro – Your smart PIXEL (TAG) Manager
<12.6.8Update to 12.6.8
- Medium5.3Missing Authorization
Infility Global
≤2.16.24Update to 2.16.25
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
WP Ultimate Review
≤2.4.4Update to 2.4.5
- Medium5.3Unauthenticated Insecure Direct Object Reference
FluentCart – Online Store Builder & eCommerce Checkout
≤2.1.0Update to 2.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
DiviGear Carousel
≤5.2.0Update to 5.2.2
- High7.5Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
EventON - Subscriber
≤1.4.5No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Mang Board
≤2.4.4Update to 2.4.5
- Medium5.3Missing Authorization
BjornTech Swish for WooCommerce
≤3.7.8Update to 3.7.9