Database
WordPress Vulnerability Database (page 61)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection via 'inputs' Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.48Update to 1.15.49
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10.2.1Update to 8.10.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
AnyComment
≤0.3.6No patch available
- Critical9.8Unauthenticated SQL Injection via Guest Persistent Cart meta_value
Abandoned Cart Pro for WooCommerce
≤10.8.0Update to 10.8.1
- High7.5Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter
Abandoned Cart Pro for WooCommerce
≤10.8.0Update to 10.8.1
- Critical9.8Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
Abandoned Cart Pro for WooCommerce
≤10.8.0Update to 10.8.1
- Critical9.8Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
Snazzy Social Media Feed
≤2.5No patch available
- Critical9.8Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
Printcart Store – Web to Print Product Designer for WooCommerce
≤2.9.1Update to 2.9.2
- High8.1Unauthenticated PHP Object Injection
Ozisti | Augmented Reality WooCommerce Theme
≤1.1.10No patch available
- High8.1Unauthenticated PHP Object Injection
Preservation
≤1.15No patch available
- High8.1Unauthenticated PHP Object Injection
Printy
≤1.13.0No patch available
- High8.1Cryptocurrency & Coin ICO WordPress <= 1.2.6 - Unauthenticated PHP Object Injection
RexCoin - Cryptocurrency & Coin ICO WordPress
≤1.2.6No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Link Whisper Free
≤0.9.7Update to 0.9.8
- Medium6.1Reflected Cross-Site Scripting
Link Whisper Free
≤0.9.7Update to 0.9.8
- High7.3Unauthenticated Privilege Escalation
ACF Frontend Admin by DynamiApps
≤3.29.13Update to 3.30.0
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
YayMail – WooCommerce Email Customizer
≤4.4.6Update to 4.4.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- High7.5Unauthenticated SQL Injection
Link Whisper Free
≤0.9.7Update to 0.9.8
- Medium5.3Unauthenticated Insecure Direct Object Reference
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤6.5.2Update to 6.5.3
- High7.5Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
Membership & User Roles for WooCommerce (Automatic Role Changer)
≤20260828Update to 20261007
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10.2.1Update to 8.10.3
- Medium5.3Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
Database Addon for Contact Form 7 – CFDB7
≤1.4.1Update to 1.4.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Social Share Buttons
≤1.31No patch available
- Critical9.1Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
Click to Chat – HoliThemes
≤4.44Update to 4.45
- High8.1Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
BP Profile Search
≤5.9Update to 6.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Booking Package
≤1.7.29Update to 1.7.30
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
Booking Package
≤1.7.29Update to 1.7.30
- High7.5Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
≤2.10.6Update to 2.10.7
- High7.5Unauthenticated SQL Injection
Mang Board
≤2.4.4Update to 2.4.5
- Medium4.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0