Database
WordPress Vulnerability Database (page 55)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant
Lightweight Cookie Notice – Cookie Banner for Cookie Consent
≤1.19Update to 1.20
- High7.2Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter
Schema & Structured Data for WP & AMP
≤1.67Update to 1.68
- Medium6.1Reflected Cross-Site Scripting
PAYCOMET for WooCommerce
≤5.45Update to 5.46
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.9Update to 10.31.10
- High7.2Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
Simply Schedule Appointments
≤1.6.12.35Update to 1.6.12.37
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute
Quick PayPal Payments: Payment Button & Form
≤6.0.4Update to 6.0.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.1Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via First Name Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.8Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
PilotPress
≤2.0.43Update to 2.0.44
- High7.2Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.3Update to 3.3.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
≤1.9.2.1Update to 1.10.0
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
≤1.9.2.1Update to 1.10.0
- Critical9.8Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
My Calendar – Accessible Event Manager
≤3.8.7Update to 3.4.25 or 3.5.22 or 3.6.18 or 3.7.18 or 3.8.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.3Update to 3.3.4
- High7.5Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
≤4.7.11Update to 4.7.12
- High8.1Unauthenticated Authentication Bypass via Delay OTP Grace State
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.8Update to 5.6.0
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.11Update to 3.0.12
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
Mang Board
≤2.4.4Update to 2.4.5
- High7.2Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX
Mang Board
≤2.4.3Update to 2.4.4
- Critical9.8Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
≤1.2.78.6Update to 1.2.78.7
- Critical9.82.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
Mang Board
2.4.4 – 2.4.4Update to 2.4.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via parser_callback
Broken Link Checker
≤2.4.14.1Update to 2.4.15
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow
Bulk Page Generator – LPagery
≤3.1.0Update to 3.1.1
- Medium6.5Authenticated (Custom+) SQL Injection via 'filters' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.4Update to 1.31.5
- High7.5Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.4.1Update to 0.1.4.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
Klarna for WooCommerce
≤4.13.3Update to 4.13.4
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
≤1.2.0Update to 1.3.0