Database
WordPress Vulnerability Database (page 63)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.7Update to 2.12.8
- Medium5.3Missing Authorization
Quick PayPal Payments: Payment Button & Form
≤6.0.3Update to 6.0.4
- Medium5.3Unauthenticated Information Exposure
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.3Update to 2.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.4Update to 4.8.5
- Medium4.9Authenticated (Editor+) SQL Injection
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.1.1Update to 1.1.2
- Medium5.3Unauthenticated Information Exposure
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium5.3Missing Authorization
Spin Wheel – Interactive spinning wheel that offers coupons
≤2.2.0Update to 2.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium4.3Missing Authorization
Easy HTTPS Redirection (SSL)
≤2.0.1Update to 2.0.2
- High7.5Unauthenticated SQL Injection
Mobile builder
≤1.4.2No patch available
- Medium5.3Unauthenticated Payment Bypass
Coinbase Commerce Payment Gateway for WooCommerce
≤1.4.1No patch available
- Medium5.3Missing Authorization
eaSYNC Booking – Hotels, Restaurants & Car Rentals
≤1.3.30Update to 1.3.31
- Medium5.3Unauthenticated Arbitrary HTML Attribute Injection
Broken Link Checker
≤2.4.14.1Update to 2.4.15
- Medium5.3Missing Authorization
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- High7.35.5.2 - Unauthenticated Arbitrary Order Status Modification
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
3.7.1 – 5.5.2Update to 5.5.3
- Medium5.3Unauthenticated Information Exposure
Coinsnap Bitcoin Crowdfunding
≤1.2.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Testimonials
≤1.4.13No patch available
- Medium5.3Unauthenticated Information Exposure
Document Gallery
≤5.1.1Update to 5.1.2
- Medium6.45.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Document Gallery
4.0 – 5.1.1Update to 5.1.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
MLS On The Fly
≤1.8.1.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Weaver Xtreme Theme Support
≤7.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
FV Simpler SEO
≤1.9.7Update to 1.9.8
- Medium4.3Missing Authorization
Download Monitor integration for WooCommerce
≤1.0.3Update to 1.0.4
- Medium5.3Unauthenticated Information Exposure
WPGraphQL
≤2.26.0Update to 2.26.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.7.1Update to 4.7.2
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.23Update to 2.9.24
- Medium5.3Missing Authorization
Pay for Payment for WooCommerce – Payment Gateway Fees & Discounts
≤3.0.1Update to 3.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1