Database
WordPress Vulnerability Database (page 67)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
≤2.2.4Update to 2.2.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool
≤3.0.0Update to 4.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
PeproDev Ultimate Profile Solutions
≤8.2.36Update to 8.2.37
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.31Update to 1.7.32
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤6.1.2Update to 6.2.0
- High7.5Unauthenticated Arbitrary File Read via 'svg_image' Parameter
Divi Plus
≤2.4.0Update to 2.4.1
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress
≤5.2.12Update to 5.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.16.0.5Update to 3.16.0.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤5.8.4Update to 5.8.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
Avada | Website Builder For WordPress & WooCommerce
≤7.16.1Update to 7.16.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
WPAdverts – Classifieds Plugin
≤2.3.4Update to 2.3.5
- High7.5Unauthenticated SQL Injection via 'booking[service_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
Email Marketing for WordPress and WooCommerce – Retainful
≤1.0.10Update to 1.0.11
- Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
SureDash – Community, Courses & Member Dashboard
≤1.12.1Update to 1.12.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤44.1Update to 45.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
Motors – Car Dealership & Classified Listings Plugin
≤1.4.124Update to 1.4.125
- High7.5Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
≤5.0.2Update to 5.0.3
- High8.1Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤44.1Update to 45.0
- Medium4.7Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤2.0.2.1Update to 2.0.2.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
WP Directory Kit
≤1.5.9Update to 1.6.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
Premium Packages – Sell Digital Products Securely
≤7.2.6Update to 7.2.7
- Critical9.8Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
WPCOM Member
≤1.7.27Update to 1.8.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
WP Photo Album Plus
≤9.3.03.002Update to 9.3.03.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.12Update to 4.3.13
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
WP Meteor Website Speed Optimization Addon
≤3.4.18Update to 3.4.19
- Medium5.4Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.5Update to 6.2.6
- High7.2Authenticated (Custom+) PHP Object Injection via 'value' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Critical9.1Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
PPOM – Product Addons & Custom Fields for WooCommerce
≤34.0.10Update to 34.0.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
ACF Frontend Admin by DynamiApps
≤3.28.36Update to 3.29.1