Database
WordPress Vulnerability Database (page 68)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- High7.2Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
VikBooking Hotel Booking Engine & PMS
≤1.8.15Update to 1.8.16
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.8Update to 2.34.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
Team – Team Members Showcase Plugin
≤6.0.2Update to 6.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via display_name User Field
Post Grid Gutenberg Blocks – PostX
≤5.1.0Update to 5.1.1
- Low3.7Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
SpeedyCache – Cache, Optimization, Performance
≤1.4.2Update to 1.4.3
- Medium6.5Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
SiteOrigin Widgets Bundle
≤1.74.3Update to 1.75.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
Simple Membership
≤4.8.4Update to 4.8.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
≤2.4.0Update to 2.4.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
Responsive Lightbox & Gallery
≤2.7.9Update to 2.7.10
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.6Update to 11.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
Presto Player
≤4.5.1Update to 4.5.2
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
Post Export Import with Media
≤1.17.1Update to 1.17.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.13.2Update to 1.13.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
Podlove Podcast Publisher
≤4.5.6Update to 4.5.7
- Medium5.3Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
Order Export & Order Import for WooCommerce
≤2.7.8Update to 2.7.9
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
Noptin – Newsletter, New Post Notifications & Email Automation
≤4.3.10Update to 4.4.0
- High7.5Unauthenticated Arbitrary File Read via 'f' Parameter
Music Store – WordPress eCommerce
≤1.4.7Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.14.2Update to 5.15
- High8.8Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
≤10.2.1Update to 10.3.0
- High8.8Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.3Update to 5.7.4
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.12Update to 3.7.12.1
- Medium4.7Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.6Update to 3.6.6.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.31Update to 1.7.32
- High8.1Unauthenticated Privilege Escalation to Support User Identity Confusion
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.8.3Update to 4.9
- High8.8Authenticated (Custom+) Privilege Escalation to 'user' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9Update to 4.9.1
- Low3.1Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot
≤2.4.89Update to 2.4.90
- Low3.1Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot
≤2.4.89Update to 2.4.90
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0