Database
WordPress Vulnerability Database (page 47)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Geo Mashup
≤1.13.22Update to 1.13.23
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6
- Medium4.3Missing Authorization
Surfer – WordPress Plugin
≤1.8.0.744Update to 1.8.1.759
- High7.5Authenticated (Contributor+) Local File Inclusion
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤34.0.1Update to 34.0.2
- Medium6.1Reflected Cross-Site Scripting
ThemeHunk Customizer
≤2.8.7Update to 2.8.8
- Medium6.1Reflected Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.14Update to 7.5.15
- High7.5Unauthenticated SQL Injection
Ajax Search Lite – Live Search & Filter
≤4.14.6Update to 4.14.7
- Medium5.3Missing Authorization
YITH WooCommerce Product Bundles
≤2.29.0Update to 2.30.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Tickets and Registration
≤5.30.1Update to 5.30.2
- Medium5.3Missing Authorization
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.15Update to 6.2.16
- Medium4.3Missing Authorization
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses
≤2.11.0Update to 2.12.0
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.4Update to 2.9.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
E2Pdf – Export Pdf Tool for WordPress
≤1.32.57Update to 1.32.58
- Medium5.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.5Update to 2.3.6
- Medium5.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.7Update to 7.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YITH WooCommerce Wishlist
≤4.18.1Update to 4.19.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Team Members – Team Showcase, Team Slider, Grid, Table & Staff Directory
≤2.8.2Update to 2.8.3
- High7.5Authenticated (Contributor+) PHP Object Injection
GS Pinterest Portfolio – Pinterest Feed, Pinterest Board & Pin Widgets
≤1.9.2Update to 1.9.3
- Medium6.1Reflected Cross-Site Scripting
Live Summary for Gravity Forms
≤1.2.10Update to 1.2.11
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Strong Testimonials
≤3.3.12Update to 3.3.13
- Medium5.3Unauthenticated Information Exposure
WholesaleX – Wholesale Pricing & B2B Solution
≤3.0.8Update to 3.0.9
- Medium4.3Missing Authorization
Sensei LMS – Online Courses, Quizzes, & Learning
≤4.26.3Update to 4.26.4
- High8.8Authenticated (Subscriber+) Arbitrary PHP Code Execution
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.5Update to 6.2.0
- Medium5.3Unauthenticated Abandoned Cart Takeover
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails
<2.2.0Update to 2.2.0
- Medium6.5Authenticated (Subscriber+) SQL Injection via mec_fes_csv_export
Modern Events Calendar
<7.37.0Update to 7.37.0
- Medium5.30.3.9 - Missing Authorization
Wava Payment Plugin
0.3.1 – 0.3.9Update to 0.3.10
- High7.2Unauthenticated Stored Cross-Site Scripting
Jane Menu
≤1.5.0Update to 1.5.1