Database
WordPress Vulnerability Database (page 51)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Subscriber+) PHP Object Injection
Strong Testimonials
≤3.3.12Update to 3.3.13
- High7.3Unauthenticated Privilege Escalation
OTP Login With Phone Number, OTP Verification
≤1.8.77Update to 1.8.78
- Medium5.3Missing Authorization
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership
≤3.4.6Update to 3.4.7
- High8.1Unauthenticated PHP Object Injection
WPBot – ChatBot Conversational Forms
≤1.5.1Update to 1.5.2
- High7.5Unauthenticated SQL Injection
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.29Update to 1.0.30
- Medium5.3Unauthenticated Insecure Direct Object Reference
Electronic Signature Add-on for Fluent Forms
≤2.0.5Update to 2.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
PowerPack Lite for Beaver Builder
≤1.3.1Update to 1.3.2
- High7.3Unauthenticated Privilege Escalation
OttoKit: All-in-One Automation Platform
≤1.1.40Update to 1.1.41
- High7.2Unauthenticated Stored Cross-Site Scripting
Simply Schedule Appointments
≤1.6.12.35Update to 1.6.12.37
- Medium6.1Reflected Cross-Site Scripting
eStore
≤1.6.13Update to 1.6.14
- Medium4.3Missing Authorization
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
≤5.4.14Update to 6.0.0
- Medium5.3Missing Authorization
Site Reviews
≤8.3.4Update to 8.3.5
- Medium6.5Authenticated (Subscriber+) Arbitrary CSS Injection
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Critical9.8Unauthenticated Embedded Malicious Code
Rank Math SEO PRO
3.0.123 – 3.0.123Update to 3.0.124
- Medium5.31.2.9 - Unauthenticated Information Exposure
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.33.11.0 - Missing Authorization
Snap Finance
1.0.8 – 3.11.0Update to 3.12.0
- Medium4.3Missing Authorization
ElementsReady Addons for Elementor
≤6.7.2No patch available
- Medium5.31.2.9 - Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium6.1Reflected Cross-Site Scripting
WP Photo Album Plus
≤9.2.11.1Update to 9.2.11.002
- High8.810.31.10 - Authenticated (Salon Staff+) Privilege Escalation
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
10.17 – 10.31.10Update to 10.31.11
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Blaze Demo Importer
≤1.0.16Update to 1.0.17
- Medium5.35.7.0 - Missing Authorization
App Builder – Create Native Android & iOS Apps On The Flight
3.8.4 – 5.7.0Update to 5.7.1
- Medium5.31.2.9 - Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.31.2.9 - Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.3Missing Authorization
ElementsReady Addons for Elementor
≤6.7.2No patch available
- Medium5.3Unauthenticated Information Exposure
FormFlow for GoHighLevel (GHL) – Send Form Leads to GHL CRM
≤1.0.0Update to 1.0.1
- Medium5.3Unauthenticated Payment Bypass
iPOSpays Payment Gateway for WooCommerce
≤1.4.6Update to 1.4.7
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Medium5.3Missing Authorization
2Way VideoCalls and Random Chat – HTML5 Webcam Videochat
≤6.1.5Update to 6.1.6