Database
WordPress Vulnerability Database (page 48)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.8Unauthenticated HTML Injection
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
<1.26.15Update to 1.26.15
- Medium4.3Missing Authorization
Sensei LMS – Online Courses, Quizzes, & Learning
≤4.26.3Update to 4.26.4
- Medium5.3Missing Authorization
SUMIT Payment Gateway for WooCommerce
<4.0.0Update to 4.0.0
- Medium5.3Unauthenticated Account Activation Bypass
WholesaleX – Wholesale Pricing & B2B Solution
<3.0.9Update to 3.0.9
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Kliken: Ads + Pixel for Meta
≤1.2.2Update to 1.2.3
- Medium5.3Unauthenticated Information Exposure
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium5.3Unauthenticated Insecure Direct Object Reference
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- Medium4.3Missing Authorization
Backup and Staging by WP Time Capsule
≤1.22.27Update to 1.22.28
- Low2.7Missing Authorization
Uncanny Toolkit for LearnDash
≤3.8.1Update to 3.8.2
- High8.8Cross-Site Request Forgery
Uncanny Toolkit for LearnDash
<3.8.2Update to 3.8.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar
<7.37.0Update to 7.37.0
- Medium5.3Unauthenticated Payment Forgery
Snap Finance
<3.12.0Update to 3.12.0
- Medium5.31.1.2 - Unauthenticated Information Exposure
Click n Chat (Chat Widget Integration)
1.0.4 – 1.1.2Update to 1.1.3
- High7.51.1.2 - Unauthenticated SQL Injection
Click n Chat (Chat Widget Integration)
1.0.4 – 1.1.2Update to 1.1.3
- High7.5Unauthenticated SQL Injection
Click n Chat (Chat Widget Integration)
≤1.1.2Update to 1.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Translate WordPress with Weglot 2.0 – Multilingual AI Translation
≤6.4.2Update to 6.4.3
- Medium5.30.3.9 - Missing Authorization
Wava Payment Plugin
0.3.1 – 0.3.9Update to 0.3.10
- Medium4.3Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery
Download Manager
≤7.5.8Update to 3.3.71 or 7.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.4Update to 4.3.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.4Update to 4.3.5
- Medium5.3Missing Authorization
TI WooCommerce Wishlist
≤2.12.0Update to 2.13.0
- High7.32.9.25 - Unauthenticated Privilege Escalation
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
2.9.21 – 2.9.25Update to 2.9.26
- Medium4.36.3.0 - Two-Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
6.2.9 – 6.3.0Update to 6.3.1
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Pricing Table WordPress Plugin – Easy Pricing Tables
≤4.1.2Update to 4.1.3
- Critical9.1Unauthenticated Arbitrary File Deletion
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.28Update to 1.6.29
- High7.23.2.11 - Unauthenticated Stored Cross-Site Scripting
Redirection for Contact Form 7
2.2.7 – 3.2.11Update to 3.2.12
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.5Update to 3.8.6
- Medium6.5Authenticated (Author+) SQL Injection
Swift Performance Lite
≤2.3.7.3Update to 2.3.7.4
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
WPZOOM Portfolio Lite – Filterable Portfolio Plugin
≤1.4.33Update to 1.4.34