Database
WordPress Vulnerability Database (page 57)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
Mang Board
≤2.4.0Update to 2.4.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
Ocean Extra
≤2.6.0Update to 2.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
VK Blocks
≤1.126.1Update to 1.126.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
≤1.27.13Update to 1.27.14
- High7.2Unauthenticated Stored Cross-Site Scripting via 'order_email'
Premium Packages – Sell Digital Products Securely
≤7.0.5Update to 7.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5.14Update to 4.5.15
- Medium6.1Reflected Cross-Site Scripting via 'title' Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.42Update to 1.8.43
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
Import and export users and customers
≤2.4.5Update to 2.4.6
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.9.6Update to 7.9.7
- Medium6.1Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
Tracking Code Manager
≤2.6.0Update to 2.7.0
- High7.5Unauthenticated SQL Injection via 'link_url' Parameter
Link Library
≤7.9.2Update to 7.9.3
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1
- High7.3Unauthenticated Server-Side Request Forgery via 'src' Parameter
PhastPress
≤3.10Update to 3.11
- Critical9.8Unauthenticated Arbitrary File Upload via 'page_id' Parameter
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.10Update to 2.34.11
- Critical9.8Unauthenticated Remote Code Execution
The Grid
≤2.8.1Update to 2.8.2
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
FV Flowplayer Video Player
≤7.5.54.7212Update to 7.5.55.7212
- Medium4.3Authenticated (Subscriber+) Information Exposure
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.2Update to 10.31.3
- Medium6.42.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Pricing Table – Block – Show Product or Service Pricing in Table Format
1.0.7 – 2.1.4Update to 2.1.5
- Medium5.3Missing Authorization
Patreon WordPress
≤1.9.0Update to 1.10.0
- High8.8Authenticated (Contributor+) Remote Code Execution
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
<3.9.1Update to 3.9.1
- Medium5.3Missing Authorization
Robokassa payment gateway for Woocommerce
<1.9.0Update to 1.9.0
- High7.3Missing Authorization to Unauthenticated Settings Modification
LTL Freight Quotes – ODFL Edition
<4.2.19Update to 4.2.19
- Medium5.3Unauthenticated Arbitrary Payment Status Manipulation
CamPay Shortcode Payment Gateway
<1.7Update to 1.7
- Medium5.3Missing Authorization
AWP Classifieds
<4.4.9Update to 4.4.9
- High8.1Unauthenticated PHP Object Injection
Gravity Forms
<3.1.1Update to 3.1.1
- Medium6.1Reflected Cross-Site Scripting
Houzez
≤4.4.0Update to 4.4.1
- High7.5Unauthenticated SQL Injection
Green Popups
<7.6.3Update to 7.6.3
- Medium5.32.5.2 - Missing Authorization
Sifalo Pay
2.0 – 2.5.2Update to 2.5.3
- Medium5.32.5.2 - Missing Authorization
Sifalo Pay
2.0 – 2.5.2Update to 2.5.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
rtMedia for WordPress, BuddyPress and bbPress
<4.7.14Update to 4.7.14