Database
WordPress Vulnerability Database (page 62)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Privilege Escalation
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
≤3.2.5Update to 3.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.1Update to 3.6.2
- High7.5Unauthenticated SQL Injection
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- High7.2Unauthenticated Stored Cross-Site Scripting
BSK PDF Manager
≤3.8.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Crowdfunding
≤2.2.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Chained Quiz
≤1.4.1Update to 1.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Cincopa video and media plug-in
≤1.165No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Podamibe Custom User Gravatar
≤1.0.8No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Razorpay Payment Button Elementor Plugin
≤1.2.8No patch available
- High8.1Unauthenticated PHP Object Injection
GEO my WP
≤4.5.5.3Update to 4.5.5.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Bitcoin Payments – Blockonomics
3.11.0 – 3.11.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Video Gallery – YouTube Gallery, Playlist & Video Grid
≤4.1.0No patch available
- Medium4.3Missing Authorization
Visual Form Builder
≤3.1No patch available
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium5.3Unauthenticated Information Exposure
Subscribe to Comments
≤2.3.2Update to 2.3.3
- High7.3Unauthenticated Arbitrary Order Status Manipulation
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
≤5.5.2Update to 5.5.3
- High7.5Unauthenticated SQL Injection
WX Subscribe 微信支付付费订阅
≤1.2.1No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
WP-BusinessDirectory – Business directory plugin for WordPress
≤4.0.2No patch available
- Medium5.35.1.1 - Unauthenticated Document Thumbnail Replacement
Document Gallery
4.1 – 5.1.1Update to 5.1.2
- Medium6.1Reflected Cross-Site Scripting
Document Gallery
≤5.1.1Update to 5.1.2
- Critical9.8Unauthenticated Remote Code Execution
AjaxLoadMore Cache
≤3.1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
IMPress for IDX Broker
≤3.3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Responsive Slider
≤0.1.9No patch available
- High8.1Unauthenticated PHP Object Injection
Quirky - NFT, Token & Artist Marketplace WordPress Theme
≤1.23No patch available
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- Medium5.3Missing Authorization
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium4.3Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.1.0Update to 2.2.0
- Medium4.9Authenticated (Editor+) SQL Injection
Link Whisper Free
≤0.9.7Update to 0.9.8
- High7.3Unauthenticated Privilege Escalation
User Rights Access Manager
≤1.1.3No patch available