Database
WordPress Vulnerability Database (page 58)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Insufficient Authorization to Booking API Access
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium4.3Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
<8.0.6Update to 8.0.6
- Medium5.3Unauthenticated Information Exposure
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
<5.5.84Update to 5.5.84
- Medium5.3Missing Authorization
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
<5.5.77Update to 5.5.77
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
<3.6.15Update to 3.6.15
- Medium5.3Unauthenticated Insecure Direct Object Reference
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails
<2.1.4Update to 2.1.4
- Medium5.3Missing Authorization
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster
<2.8.0Update to 2.8.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
Tainacan
<1.4.0Update to 1.4.0
- Medium5.3Missing Authorization
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
<5.3.2Update to 5.3.2
- Medium5.3Missing Authorization
Trust Payments Gateway for WooCommerce
<3.1.0Update to 3.1.0
- Medium6.47.5.55.7211 - Authenticated (Contributor+) Server-Side Request Forgery
FV Flowplayer Video Player
7.5.44.7212 – 7.5.55.7211Update to 7.5.55.7212
- Medium4.9Authenticated (Editor+) SQL Injection
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.8.8Update to 3.8.9
- Low2.7Missing Authorization
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤4.3.3Update to 4.3.4
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium5.3Missing Authorization
WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect
<7.8.8.2Update to 7.8.8.2
- Medium5.3Unauthenticated Payment Bypass
Visma Pay for Woocommerce
<1.2.2Update to 1.2.2
- Medium5.38.0.5 - Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
7.9.5 – 8.0.5Update to 8.0.6
- Medium5.39.3.0 - Unauthenticated Insecure Direct Object Reference
NEX-Forms – Ultimate Forms Plugin for WordPress
9.2.1 – 9.3.0Update to 9.3.1
- High7.5Unauthenticated Arbitrary File Read
Contact Form 7 Signature Addon
≤4.2.2No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
Ukr-To-Lat
≤1.3.5No patch available
- High7.3Unauthenticated Snippet Safe Mode Bypass
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
<2.4.0Update to 2.4.0
- Medium5.3Missing Authorization
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Email
Responsive Blocks – Page Builder for Blocks & Patterns
<2.3.0Update to 2.3.0
- High7.3Unauthenticated Arbitrary Order Status Manipulation
Paymentfor Gateway for WooCommerce
<1.0.6Update to 1.0.6
- Medium5.32.5.2 - Missing Authorization
Sifalo Pay
2.0 – 2.5.2Update to 2.5.3
- Medium6.5Authenticated (Contributor+) SQL Injection
BSK PDF Manager
<3.8.2Update to 3.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Forms
<3.0.2Update to 3.0.2
- Medium6.42.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Pricing Table – Block – Show Product or Service Pricing in Table Format
1.0.7 – 2.1.4Update to 2.1.5
- Medium5.32.0.2.1 - Unauthenticated Payment Bypass on Paid Forms
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.10.0.1 – 2.0.2.1Update to 2.0.2.2