Database
WordPress Vulnerability Database (page 69)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Privilege Escalation to Support User Identity Confusion
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.8.3Update to 4.9
- High8.8Authenticated (Custom+) Privilege Escalation to 'user' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9Update to 4.9.1
- Low3.1Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot
≤2.4.89Update to 2.4.90
- Low3.1Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot
≤2.4.89Update to 2.4.90
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- High8.1Unauthenticated Local File Inclusion via 'design_type' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.187Update to 2.8.188
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
FV Player 8
≤8.1.7Update to 8.1.8
- High8.8Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
FooSales – Point of Sale (POS) for WooCommerce
≤1.43.0Update to 1.43.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
Church Admin
≤5.1.2Update to 5.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
Getwid – Gutenberg Blocks
≤3.0.1Update to 3.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
Table Field Add-on for ACF and SCF
≤1.3.35Update to 1.3.40
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
≤2.7.13Update to 2.7.14
- Medium5.3Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
Booking Calendar
≤11.4.3Update to 11.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
Graphene
≤2.9.4Update to 2.9.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
Real Estate Manager – Property Listing and Agent Management
≤7.3Update to 7.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
Brizy – Page Builder
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.12.03Update to 1.12.04
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.9.4Update to 7.9.5
- High7.2Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.6.9Update to 3.6.9.1
- Medium6.1Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
Download Manager
≤3.3.57Update to 3.3.58
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
Download Manager
≤3.3.58Update to 3.3.59
- Medium5.3Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
Simply Schedule Appointments
≤1.6.11.11Update to 1.6.12.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.188Update to 2.8.189
- Critical9.1Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
Avada (Fusion) Builder
≤3.16.1Update to 3.16.2
- Medium5.4Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site
Hello Plus
≤1.7.7Update to 1.7.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
FV Flowplayer Video Player
≤7.5.54.7212Update to 7.5.55.7212
- Medium6.1Reflected Cross-Site Scripting via 'inputs' Parameter Array Key
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.48Update to 1.15.49
- Medium4.7Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.14Update to 6.2.15
- Medium5.3Authenticated (Author+) SQL Injection via FireBox Form Display Condition
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
≤3.1.13Update to 3.1.14
- Medium6.1Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
Filter Everything — WordPress & WooCommerce Filters
≤1.9.6Update to 1.9.7