Database
WordPress Vulnerability Database (page 52)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
FormFlow for GoHighLevel (GHL) – Send Form Leads to GHL CRM
≤1.0.0Update to 1.0.1
- Medium5.3Unauthenticated Payment Bypass
iPOSpays Payment Gateway for WooCommerce
≤1.4.6Update to 1.4.7
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Medium5.3Missing Authorization
2Way VideoCalls and Random Chat – HTML5 Webcam Videochat
≤6.1.5Update to 6.1.6
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Modern Events Calendar Lite
≤7.36.3Update to 7.36.4
- Medium4.3Authenticated (Subscriber+) Information Exposure
Modern Events Calendar Lite
≤7.36.0Update to 7.37.0
- Medium4.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium5.3Unauthenticated Negative Booking Total Creation
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium6.4Authenticated (Salon Staff+) Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium4.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium4.31.2.10 - Missing Authorization
Tasty Recipes Lite – WordPress Recipe Card Plugin with Built-In Recipe Schema
1.2 – 1.2.10Update to 1.2.11
- Medium4.7Unauthenticated Open Redirect
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
≤3.2.2Update to 3.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.29Update to 1.0.30
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
Fastcache by Host.it
≤1.7.5Update to 1.7.6
- Medium5.3Missing Authorization
ActiveTrail for WooCommerce
≤1.2.6Update to 1.2.7
- Medium5.3Missing Authorization
Gateway for Vantiv on WC
≤1.0.1No patch available
- Medium5.31.3.12 - Missing Authorization
BDM Digital Payment Gateway
1.2.7 – 1.3.12Update to 1.3.13
- High7.2Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
WP Sessions Time Monitoring Full Automatic
≤1.1.5Update to 1.1.6
- Medium5.4Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
Events Made Easy
≤3.2.22Update to 3.2.23
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.191Update to 2.8.192
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body
GoSMTP Pro
≤1.2.3Update to 1.2.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint
DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More
≤1.5.1Update to 1.6.0
- High7.2Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute
Name Directory
≤1.34.2Update to 1.34.3
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.5Update to 4.17.6
- High7.5Unauthenticated SQL Injection via 'src_by' Parameter
Vitepos – Point of Sale (POS) for WooCommerce
≤3.5.1Update to 3.6.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting
Social Share Buttons
≤1.30Update to 1.31
- High7.2Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin
≤6.2.9Update to 6.3.0