Database
WordPress Vulnerability Database (page 59)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
Email Customizer for WooCommerce (Pro)
≤3.9.5Update to 3.9.6
- Critical9.8Unauthenticated Account Takeover
OTP Login & Register Woocommerce
≤2.7.2Update to 2.7.3
- Medium4.3Cross-Site Request Forgery
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.2Update to 10.31.3
- Medium6.5Authenticated (Contributor+) SQL Injection
CP Multi View Events Calendar
≤1.4.41Update to 1.4.42
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
<3.7.4Update to 3.7.4
- High8.1Unauthenticated Local File Inclusion
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
<2.17.2Update to 2.17.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
<3.6.16Update to 3.6.16
- High7.2Unauthenticated Stored Cross-Site Scripting
LTL Freight Quotes – ODFL Edition
<4.2.19Update to 4.2.19
- High7.3Missing Authorization to Unauthenticated Settings Modification
LTL Freight Quotes – ODFL Edition
<4.2.19Update to 4.2.19
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Booking System – Booking Calendar
<2.1.0.1Update to 2.1.0.1
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
<6.1.1Update to 6.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gutenverse Form – Contact Form Builder, Block Form & Booking Form
<3.0.11Update to 3.0.11
- Medium5.3Unauthenticated Insecure Direct Object Reference
CodeAtoZ B2B Suite for WooCommerce
<1.6.1Update to 1.6.1
- Medium6.44.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
4.10.1 – 4.10.5Update to 4.10.6
- Medium5.3Missing Authorization to Unauthenticated SEO Data Deletion
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.280Update to 1.0.280
- High7.5Unauthenticated SQL Injection
Walletdoc Payment Gateway for WooCommerce
<1.8.5Update to 1.8.5
- High7.5Unauthenticated SQL Injection
Green Popups
<7.6.3Update to 7.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Donation Thermometer
<2.3.0Update to 2.3.0
- High7.55.2.3 - Unauthenticated SQL Injection
Fast Courier – Shipping & Freight
5.0.0 – 5.2.3Update to 5.2.4
- High8.8Authenticated (Contributor+) Remote Code Execution
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
<3.9.1Update to 3.9.1
- Low2.7Authenticated (Administrator+) Insecure Direct Object Reference
WP 2FA – Two-factor authentication for WordPress
<4.2.0Update to 4.2.0
- Critical9.8Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
≤3.10.0Update to 3.10.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
Record of Consent Extension for Complianz
≤2.5Update to 2.6
- High8.1Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
ShopMagic – email automation for WordPress
≤4.9.0Update to 4.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PeproDev Branches Map (Mapify)
≤3.0.1Update to 3.0.2
- High7.2Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
Post Export Import with Media
≤1.17.1Update to 1.17.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
Meow Lightbox
≤5.6.2Update to 5.6.3
- High8.1Unauthenticated Local File Inclusion via '<mode>_type' Parameter
Mang Board
≤2.4.3Update to 2.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
Mang Board
≤2.4.3Update to 2.4.4