Database
WordPress Vulnerability Database (page 68)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
WP File Download
≤6.3.9Update to 6.3.10
- Medium6.1Reflected Cross-Site Scripting via 'fvrt_' prefix
Favicon Rotator
≤1.2.11Update to 1.2.12
- Medium5.3Missing Authorization to Unauthenticated PNG File Upload
WP CV Builder
≤1.3.1Update to 1.3.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
WP Booking System – Booking Calendar
≤2.1.0.1Update to 2.1.0.2
- Medium6.1Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
Payment Plugins for Stripe WooCommerce
≤4.0.17Update to 4.0.18
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- High7.2Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
VikBooking Hotel Booking Engine & PMS
≤1.8.15Update to 1.8.16
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.8Update to 2.34.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
Team – Team Members Showcase Plugin
≤6.0.2Update to 6.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via display_name User Field
Post Grid Gutenberg Blocks – PostX
≤5.1.0Update to 5.1.1
- Low3.7Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
SpeedyCache – Cache, Optimization, Performance
≤1.4.2Update to 1.4.3
- Medium6.5Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
SiteOrigin Widgets Bundle
≤1.74.3Update to 1.75.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
Simple Membership
≤4.8.4Update to 4.8.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
≤2.4.0Update to 2.4.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
Responsive Lightbox & Gallery
≤2.7.9Update to 2.7.10
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.6Update to 11.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
Presto Player
≤4.5.1Update to 4.5.2
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
Post Export Import with Media
≤1.17.1Update to 1.17.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.13.2Update to 1.13.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
Podlove Podcast Publisher
≤4.5.6Update to 4.5.7
- Medium5.3Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
Order Export & Order Import for WooCommerce
≤2.7.8Update to 2.7.9
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
Noptin – Newsletter, New Post Notifications & Email Automation
≤4.3.10Update to 4.4.0
- High7.5Unauthenticated Arbitrary File Read via 'f' Parameter
Music Store – WordPress eCommerce
≤1.4.7Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.14.2Update to 5.15
- High8.8Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
≤10.2.1Update to 10.3.0
- High8.8Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.3Update to 5.7.4
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.12Update to 3.7.12.1
- Medium4.7Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.6Update to 3.6.6.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.31Update to 1.7.32