Database
WordPress Vulnerability Database (page 62)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Authenticated (Contributor+) Privilege Escalation
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
≤3.2.5Update to 3.2.6
- Medium5.3Unauthenticated Information Exposure
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.1Update to 1.8.0
- High7.3Unauthenticated Privilege Escalation
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
≤3.2.5Update to 3.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.1Update to 3.6.2
- High7.5Unauthenticated SQL Injection
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- High7.2Unauthenticated Stored Cross-Site Scripting
BSK PDF Manager
≤3.8.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Crowdfunding
≤2.2.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Chained Quiz
≤1.4.1Update to 1.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Cincopa video and media plug-in
≤1.165No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Podamibe Custom User Gravatar
≤1.0.8No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Razorpay Payment Button Elementor Plugin
≤1.2.8No patch available
- High8.1Unauthenticated PHP Object Injection
GEO my WP
≤4.5.5.3Update to 4.5.5.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Bitcoin Payments – Blockonomics
3.11.0 – 3.11.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Video Gallery – YouTube Gallery, Playlist & Video Grid
≤4.1.0No patch available
- Medium4.3Missing Authorization
Visual Form Builder
≤3.1No patch available
- Medium5.3Missing Authorization
Pay for Payment for WooCommerce – Payment Gateway Fees & Discounts
≤3.0.1Update to 3.0.2
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- High7.35.5.2 - Unauthenticated Arbitrary Order Status Modification
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
3.7.1 – 5.5.2Update to 5.5.3
- Medium5.3Missing Authorization
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- High7.3Unauthenticated Arbitrary Order Status Manipulation
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
≤5.5.2Update to 5.5.3
- Medium5.3Unauthenticated Information Exposure
Coinsnap Bitcoin Crowdfunding
≤1.2.0No patch available
- High7.5Unauthenticated SQL Injection
WX Subscribe 微信支付付费订阅
≤1.2.1No patch available
- Medium5.3Unauthenticated Information Exposure
Subscribe to Comments
≤2.3.2Update to 2.3.3
- Critical9.8Unauthenticated Arbitrary File Upload
WP-BusinessDirectory – Business directory plugin for WordPress
≤4.0.2No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Testimonials
≤1.4.13No patch available
- Medium5.3Unauthenticated Information Exposure
Document Gallery
≤5.1.1Update to 5.1.2
- Medium5.35.1.1 - Unauthenticated Document Thumbnail Replacement
Document Gallery
4.1 – 5.1.1Update to 5.1.2
- Medium6.45.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Document Gallery
4.0 – 5.1.1Update to 5.1.2
- Medium6.1Reflected Cross-Site Scripting
Document Gallery
≤5.1.1Update to 5.1.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
MLS On The Fly
≤1.8.1.5No patch available