Database
WordPress Vulnerability Database (page 56)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9.3Update to 4.9.4
- Medium6.1Reflected Cross-Site Scripting via 'permalink' Parameter
Gwolle Guestbook
≤5.1.1Update to 5.1.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.16.0.6Update to 3.17.0
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.0Update to 1.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
≤1.2.4Update to 1.2.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.0Update to 1.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.11Update to 5.2.12
- High8.1Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
Customer Email Verification for WooCommerce
≤3.3.0Update to 3.3.1
- Medium4.3Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.2.1Update to 5.3.0
- Medium5.9Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>
Debloat – Remove Unused CSS, Optimize JS
≤1.3.0Update to 1.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter
Complianz GDPR/CCPA Cookie Consent Banner
≤7.5.5Update to 7.5.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comments
Colibri Page Builder
≤1.0.390Update to 1.0.392
- High8.0Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
Backuply – Backup, Restore, Migrate and Clone
≤1.5.8Update to 1.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute
Dark Mode – Improve Accessibility with AI Powered Dark Theme
≤5.3.17Update to 5.3.18
- Medium4.86.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
6.4.1 – 6.4.2Update to 6.4.3
- Medium5.3Unauthenticated Information Exposure
Gantry 5 Framework
≤5.6.4Update to 5.6.5
- Medium6.1Reflected Cross-Site Scripting
Fancy Comments WordPress
≤1.2.21No patch available
- Medium4.3Missing Authorization
Squeeze – Browser-Based Image Compression & WebP Converter (No API, No Limits)
≤1.8.0Update to 1.8.1
- Medium5.3Unauthenticated Reduced Booking Price
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.8.0Update to 2.8.1
- Medium5.3Unauthenticated Information Exposure
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.12.0Update to 3.12.1
- Medium5.3Missing Authorization
PickPlugins Product Designer for WooCommerce
≤1.0.40No patch available
- Medium6.6Authenticated (Administrator+) PHP Object Injection
ACF Frontend Admin by DynamiApps
≤3.29.0Update to 3.30.0
- Medium5.3Missing Authorization
ACF Frontend Admin by DynamiApps
≤3.29.0Update to 3.30.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content
Cooked – Recipe Management
≤1.16.1Update to 1.16.2
- Medium5.32.9.19 - Unauthenticated Payment Bypass
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
2.9 – 2.9.19Update to 2.9.20
- Medium5.3Unauthenticated Information Exposure
MAIO – ChatGPT SEO Tracking & AI Search Optimization
≤7.3.21Update to 7.3.22
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.87Update to 5.5.88
- Medium5.31.120.69 - Unauthenticated Information Exposure
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
1.117.9 – 1.120.69Update to 1.120.70
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
Blog2Social: Social Media Auto Post & Scheduler
≤9.1.4Update to 9.1.5
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
Elementor Website Builder – more than just a page builder
≤4.2.3Update to 4.2.4