Database
WordPress Vulnerability Database (page 64)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.23Update to 2.9.24
- Medium5.3Missing Authorization
Pay for Payment for WooCommerce – Payment Gateway Fees & Discounts
≤3.0.1Update to 3.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1
- Medium5.3Missing Authorization
FOX – Currency Switcher Professional for WooCommerce
≤1.5.4Update to 1.5.5
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
Visual Form Builder
≤3.1No patch available
- Medium6.1Reflected Cross-Site Scripting
XStore
<9.7.9Update to 9.7.9
- Medium5.33.4.1 - Unauthenticated Arbitrary Order Status Manipulation
Cardinity Payment Gateway for WooCommerce
3.2.6 – 3.4.1Update to 3.4.2
- Medium4.3Cross-Site Request Forgery
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.8Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
≤2.10.6Update to 2.10.7
- Medium4.9Authenticated (Editor+) SQL Injection via 'counterid' Parameter
Animated Number Counters
≤3.0Update to 3.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.1.0Update to 11.1.1
- Medium4.3Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium4.3Missing Authorization
WP-Members Membership Plugin
≤3.5.7Update to 3.5.8
- Medium5.3Missing Authorization
Skydropx
≤2.1.4Update to 2.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.6.27Update to 4.6.28
- Medium6.1Reflected Cross-Site Scripting
Hippoo Mobile App for WooCommerce
≤1.12.0Update to 1.12.1
- Medium6.1Reflected Cross-Site Scripting
SimplyRETS Real Estate IDX
≤3.2.9Update to 3.3.0
- Critical9.8Unauthenticated Remote Code Execution
MDTF – Meta Data and Taxonomies Filter
≤1.3.9Update to 1.4.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.17Update to 1.10.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.10.0Update to 1.11.0
- Medium5.3Missing Authorization
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.0Update to 1.58.1
- Medium4.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.8Update to 8.8.9
- Medium4.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.6Update to 7.3.7