Database
WordPress Vulnerability Database (page 59)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Trust Payments Gateway for WooCommerce
<3.1.0Update to 3.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Forms
<3.0.2Update to 3.0.2
- Medium6.47.5.55.7211 - Authenticated (Contributor+) Server-Side Request Forgery
FV Flowplayer Video Player
7.5.44.7212 – 7.5.55.7211Update to 7.5.55.7212
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
<3.7.4Update to 3.7.4
- Medium4.9Authenticated (Editor+) SQL Injection
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.8.8Update to 3.8.9
- Low2.7Missing Authorization
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤4.3.3Update to 4.3.4
- Medium4.3Cross-Site Request Forgery
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium6.5Authenticated (Contributor+) SQL Injection
CP Multi View Events Calendar
≤1.4.41Update to 1.4.42
- Low2.7Authenticated (Administrator+) Insecure Direct Object Reference
WP 2FA – Two-factor authentication for WordPress
<4.2.0Update to 4.2.0
- Medium5.3Missing Authorization
WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect
<7.8.8.2Update to 7.8.8.2
- Medium5.3Unauthenticated Payment Bypass
Visma Pay for Woocommerce
<1.2.2Update to 1.2.2
- High8.1Unauthenticated Local File Inclusion
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
<2.17.2Update to 2.17.2
- Medium5.38.0.5 - Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
7.9.5 – 8.0.5Update to 8.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Booking System – Booking Calendar
<2.1.0.1Update to 2.1.0.1
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
<6.1.1Update to 6.1.1
- Medium5.39.3.0 - Unauthenticated Insecure Direct Object Reference
NEX-Forms – Ultimate Forms Plugin for WordPress
9.2.1 – 9.3.0Update to 9.3.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
CodeAtoZ B2B Suite for WooCommerce
<1.6.1Update to 1.6.1
- Medium6.44.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
4.10.1 – 4.10.5Update to 4.10.6
- Medium5.3Missing Authorization to Unauthenticated SEO Data Deletion
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.280Update to 1.0.280
- High7.5Unauthenticated Arbitrary File Read
Contact Form 7 Signature Addon
≤4.2.2No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
Ukr-To-Lat
≤1.3.5No patch available
- High7.5Unauthenticated SQL Injection
Walletdoc Payment Gateway for WooCommerce
<1.8.5Update to 1.8.5
- High7.3Unauthenticated Snippet Safe Mode Bypass
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
<2.4.0Update to 2.4.0
- Critical9.8Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
≤3.10.0Update to 3.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
Record of Consent Extension for Complianz
≤2.5Update to 2.6
- High8.1Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
ShopMagic – email automation for WordPress
≤4.9.0Update to 4.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PeproDev Branches Map (Mapify)
≤3.0.1Update to 3.0.2
- High7.2Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
Post Export Import with Media
≤1.17.1Update to 1.17.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
Meow Lightbox
≤5.6.2Update to 5.6.3