Database
WordPress Vulnerability Database (page 57)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
VK Blocks
≤1.126.1Update to 1.126.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
≤1.27.13Update to 1.27.14
- High7.2Unauthenticated Stored Cross-Site Scripting via 'order_email'
Premium Packages – Sell Digital Products Securely
≤7.0.5Update to 7.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.5.14Update to 4.5.15
- Medium6.1Reflected Cross-Site Scripting via 'title' Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.42Update to 1.8.43
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
Import and export users and customers
≤2.4.5Update to 2.4.6
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.9.6Update to 7.9.7
- Medium6.1Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
Tracking Code Manager
≤2.6.0Update to 2.7.0
- High7.5Unauthenticated SQL Injection via 'link_url' Parameter
Link Library
≤7.9.2Update to 7.9.3
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.0Update to 6.2.1
- High7.3Unauthenticated Server-Side Request Forgery via 'src' Parameter
PhastPress
≤3.10Update to 3.11
- Critical9.8Unauthenticated Arbitrary File Upload via 'page_id' Parameter
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.10Update to 2.34.11
- Critical9.8Unauthenticated Remote Code Execution
The Grid
≤2.8.1Update to 2.8.2
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
FV Flowplayer Video Player
≤7.5.54.7212Update to 7.5.55.7212
- Medium5.3Missing Authorization
Robokassa payment gateway for Woocommerce
<1.9.0Update to 1.9.0
- Medium5.3Unauthenticated Arbitrary Payment Status Manipulation
CamPay Shortcode Payment Gateway
<1.7Update to 1.7
- Medium5.3Missing Authorization
AWP Classifieds
<4.4.9Update to 4.4.9
- High8.1Unauthenticated PHP Object Injection
Gravity Forms
<3.1.1Update to 3.1.1
- Medium6.1Reflected Cross-Site Scripting
Houzez
≤4.4.0Update to 4.4.1
- Medium5.32.5.2 - Missing Authorization
Sifalo Pay
2.0 – 2.5.2Update to 2.5.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
rtMedia for WordPress, BuddyPress and bbPress
<4.7.14Update to 4.7.14
- Medium4.7Unauthenticated Open Redirect
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium4.3Missing Authorization
YITH WooCommerce Popup
<1.60.0Update to 1.60.0
- Medium5.3Unauthenticated Arbitrary Order Payment Confirmation
Tickera – Sell Tickets & Manage Events
<3.6.0.4Update to 3.6.0.4
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Asaas Gateway for WooCommerce
<2.7.8Update to 2.7.8
- Medium5.4Unauthenticated Limited Privilege Escalation via 'process_registration'
WholesaleX – Wholesale Pricing & B2B Solution
≤3.0.8Update to 3.0.9
- Medium5.3Unauthenticated Information Exposure
bbPress
<2.6.19No patch available
- Medium5.3Missing Authorization
Restricted Site Access
≤7.6.2Update to 7.6.3
- Medium4.3Authenticated (Contributor+) Information Exposure
Product Delivery Date for WooCommerce – Lite
≤3.3.1Update to 3.3.2
- Medium4.3Missing Authorization
MB Custom Post Types & Custom Taxonomies
≤2.12.1Update to 2.12.2