Database
WordPress Vulnerability Database (page 49)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Payment Bypass
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium4.3Missing Authorization
Productive Commerce – Wishlist, Compare & MiniCart
≤1.1.48Update to 1.1.49
- Medium6.1Reflected Cross-Site Scripting
WP Booking System – Booking Calendar
≤2.1.0.2Update to 2.1.0.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool
≤4.1.0Update to 4.1.1
- Medium4.3Missing Authorization
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- Medium4.3Missing Authorization
Moloni
≤5.0.13Update to 5.0.14
- Medium5.3Unauthenticated Information Exposure
Booking Package
≤1.7.30Update to 1.7.31
- Medium5.3Missing Authorization
Booking Package
≤1.7.30Update to 1.7.31
- Medium5.3Missing Authorization
Escape Room Booking Pro
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Falang multilanguage for WordPress
≤1.4.5Update to 1.4.6
- Medium4.3Authenticated (Agent+) Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium4.35.3.2 - Authenticated (Contributor+) Payment Bypass
Simple Shopping Cart
5.1.3 – 5.3.2Update to 5.3.3
- Medium5.3Unauthenticated Payment Bypass
Simple Shopping Cart
≤5.3.2Update to 5.3.3
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Payment Gateway for Idram
<2.1.6Update to 2.1.6
- Medium5.31.1.1 - Missing Authorization
Synchrony Financing
1.0.5 – 1.1.1Update to 1.1.2
- High8.8Authenticated (Contributor+) Remote Code Execution
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.3Authenticated (Author+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.5Update to 6.8.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤4.1.2Update to 4.1.3
- High7.5Authenticated (Contributor+) PHP Object Injection
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium6.1Reflected Cross-Site Scripting
Quiz Maker by AYS
≤6.7.1.91Update to 6.7.1.92
- High8.8Authenticated (Contributor+) Arbitrary File Upload
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
Easy Property Listings
≤3.5.26Update to 3.5.27
- Medium5.3Unauthenticated Information Exposure
Easy Property Listings
≤3.5.27Update to 3.5.28
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.16.1Update to 8.16.2
- Medium5.4Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.28Update to 1.6.29
- High7.2Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
European VAT Compliance Assistant for WooCommerce
≤1.36.10Update to 1.36.11
- High7.2Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.61Update to 2.8.62
- Medium6.4Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
YMC Filter
≤3.12.19Update to 3.12.20
- Medium4.3Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
News Kit Addons For Elementor
≤1.4.8Update to 1.4.9