Database
WordPress Vulnerability Database (page 58)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.7Unauthenticated Open Redirect
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium4.3Missing Authorization
YITH WooCommerce Popup
<1.60.0Update to 1.60.0
- Medium5.3Unauthenticated Arbitrary Order Payment Confirmation
Tickera – Sell Tickets & Manage Events
<3.6.0.4Update to 3.6.0.4
- Medium5.32.0.2.1 - Unauthenticated Payment Bypass on Paid Forms
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.10.0.1 – 2.0.2.1Update to 2.0.2.2
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Asaas Gateway for WooCommerce
<2.7.8Update to 2.7.8
- High8.8Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
Email Customizer for WooCommerce (Pro)
≤3.9.5Update to 3.9.6
- Medium5.4Unauthenticated Limited Privilege Escalation via 'process_registration'
WholesaleX – Wholesale Pricing & B2B Solution
≤3.0.8Update to 3.0.9
- Medium5.3Unauthenticated Information Exposure
bbPress
<2.6.19No patch available
- Medium5.3Missing Authorization
Restricted Site Access
≤7.6.2Update to 7.6.3
- Medium4.3Authenticated (Contributor+) Information Exposure
Product Delivery Date for WooCommerce – Lite
≤3.3.1Update to 3.3.2
- Medium4.3Missing Authorization
MB Custom Post Types & Custom Taxonomies
≤2.12.1Update to 2.12.2
- Critical9.8Unauthenticated Account Takeover
OTP Login & Register Woocommerce
≤2.7.2Update to 2.7.3
- Medium6.5Insufficient Authorization to Booking API Access
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium4.3Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
<8.0.6Update to 8.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
<3.6.16Update to 3.6.16
- High7.2Unauthenticated Stored Cross-Site Scripting
LTL Freight Quotes – ODFL Edition
<4.2.19Update to 4.2.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gutenverse Form – Contact Form Builder, Block Form & Booking Form
<3.0.11Update to 3.0.11
- Medium5.3Unauthenticated Information Exposure
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
<5.5.84Update to 5.5.84
- Medium5.3Missing Authorization
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
<5.5.77Update to 5.5.77
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
<3.6.15Update to 3.6.15
- Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Email
Responsive Blocks – Page Builder for Blocks & Patterns
<2.3.0Update to 2.3.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails
<2.1.4Update to 2.1.4
- High7.3Unauthenticated Arbitrary Order Status Manipulation
Paymentfor Gateway for WooCommerce
<1.0.6Update to 1.0.6
- Medium5.3Missing Authorization
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster
<2.8.0Update to 2.8.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Donation Thermometer
<2.3.0Update to 2.3.0
- Medium6.5Authenticated (Contributor+) SQL Injection
BSK PDF Manager
<3.8.2Update to 3.8.2
- Medium4.3Authenticated (Subscriber+) Information Exposure
Tainacan
<1.4.0Update to 1.4.0
- High7.55.2.3 - Unauthenticated SQL Injection
Fast Courier – Shipping & Freight
5.0.0 – 5.2.3Update to 5.2.4
- Medium5.3Missing Authorization
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
<5.3.2Update to 5.3.2