Database
WordPress Vulnerability Database (page 55)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute
Quick PayPal Payments: Payment Button & Form
≤6.0.4Update to 6.0.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.1Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via First Name Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.8Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
PilotPress
≤2.0.43Update to 2.0.44
- High7.2Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.3Update to 3.3.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
≤1.9.2.1Update to 1.10.0
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
≤1.9.2.1Update to 1.10.0
- Critical9.8Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
My Calendar – Accessible Event Manager
≤3.8.7Update to 3.4.25 or 3.5.22 or 3.6.18 or 3.7.18 or 3.8.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.3Update to 3.3.4
- High7.5Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
≤4.7.11Update to 4.7.12
- High8.1Unauthenticated Authentication Bypass via Delay OTP Grace State
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.8Update to 5.6.0
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.11Update to 3.0.12
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
Mang Board
≤2.4.4Update to 2.4.5
- High7.2Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX
Mang Board
≤2.4.3Update to 2.4.4
- Critical9.8Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
≤1.2.78.6Update to 1.2.78.7
- Critical9.82.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
Mang Board
2.4.4 – 2.4.4Update to 2.4.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via parser_callback
Broken Link Checker
≤2.4.14.1Update to 2.4.15
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow
Bulk Page Generator – LPagery
≤3.1.0Update to 3.1.1
- Medium6.5Authenticated (Custom+) SQL Injection via 'filters' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.4Update to 1.31.5
- High7.5Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.4.1Update to 0.1.4.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
Klarna for WooCommerce
≤4.13.3Update to 4.13.4
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
≤1.2.0Update to 1.3.0
- High8.1Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9.3Update to 4.9.4
- Medium6.1Reflected Cross-Site Scripting via 'permalink' Parameter
Gwolle Guestbook
≤5.1.1Update to 5.1.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.16.0.6Update to 3.17.0
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.0Update to 1.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
≤1.2.4Update to 1.2.5