Database
WordPress Vulnerability Database (page 53)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
Vulnity Security
≤1.4.3Update to 1.4.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
FiboSearch – Ajax Search for WooCommerce
≤1.34.2Update to 1.34.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
SureDash – Community, Courses & Member Dashboard
≤1.12.0Update to 1.12.1
- Critical9.8Unauthenticated PHP Object Injection via 'key' Parameter
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.7.4Update to 3.7.5
- Medium5.3Missing Authorization
PlanetStudio Payment Gateway
≤1.3.3Update to 1.3.4
- Medium4.3Authenticated (Contributor+) Information Exposure
Infinite Uploads – Offload, Optimize & Organize Your Media Library
≤3.4.1Update to 3.4.2
- Medium4.3Missing Authorization
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤4.0.1Update to 4.0.2
- Medium4.3Missing Authorization
OTP Login With Phone Number, OTP Verification
≤1.8.77Update to 1.8.78
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Presto Player
≤4.5.3Update to 4.5.4
- Medium5.3Missing Authorization
Knowledge Base
≤3.2.0Update to 3.2.1
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.23Update to 2.3.24
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Download Monitor
≤5.3.3Update to 5.3.4
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.7.4Update to 3.7.5
- Medium5.3Missing Authorization
Ajax Search Lite – Live Search & Filter
≤4.14.5Update to 4.14.6
- Medium4.3Missing Authorization
Strong Testimonials
≤3.3.12Update to 3.3.13
- Medium5.3Missing Authorization
Ninja Forms Signature Contract Add-On
≤3.2.5Update to 3.2.5.1
- Medium5.3Missing Authorization
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.4Update to 4.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YITH WooCommerce Compare
≤3.15.0Update to 3.15.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)
≤1.5.3Update to 1.5.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.192Update to 2.8.193
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.7Update to 3.3.8
- High7.2Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
CP Multi View Events Calendar
≤1.4.42Update to 1.4.43
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute
WebberZone Top 10 — Popular Posts
≤4.5.2Update to 4.5.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
≤2.7.7Update to 2.7.8
- Medium6.8Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
Photo Engine (Media Organizer & Lightroom)
≤6.5.6Update to 6.5.7
- Medium5.4Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
WPeMatico RSS Feed Fetcher
≤2.9Update to 2.9.1
- Medium6.5Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool
WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
≤2.9.5Update to 2.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MDTF – Meta Data and Taxonomies Filter
≤1.4.0Update to 1.4.1