Database
WordPress Vulnerability Database (page 70)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
Download Manager
≤3.3.71Update to 3.3.72
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.15.1Update to 1.15.3
- High7.5Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.13Update to 4.7.14
- Critical9.8Unauthenticated Arbitrary File Upload via Signature Field File Upload
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
≤3.4.5Update to 3.4.6
- Medium6.8Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
Online Scheduling and Appointment Booking System – Bookly
≤28.4Update to 28.5
- Medium5.3Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
Online Scheduling and Appointment Booking System – Bookly
≤28.4Update to 28.5
- Critical9.1Unauthenticated Privilege Escalation to 'role' Parameter
Blocksy Companion
≤2.1.58Update to 2.1.59
- Critical9.8Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
Advanced IP Blocker
≤8.13.13Update to 8.13.14
- High8.1Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
Advanced Form Integration — Connect Forms to 300+ Apps
≤2.9.0Update to 2.10.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
Table Field Add-on for ACF and SCF
≤1.4.1-RC2Update to 1.4.1
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
Advanced Classifieds & Directory Pro
≤3.4.4Update to 3.5.0
- Medium6.5Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤4.0.3Update to 4.0.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
CodeBard Help Desk
≤1.1.2No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Tailored Tools
≤3.0.3Update to 3.0.5
- Medium5.3Unauthenticated Information Exposure
DTX – Dynamic Text Extension for Contact Form 7
≤5.0.7No patch available
- High7.5Unauthenticated SQL Injection
Directory Listings WordPress plugin – uListing
≤2.2.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Team Section Block – Showcase Team Members with Layout Options
≤2.0.4Update to 2.0.5
- High7.2Unauthenticated Server-Side Request Forgery
StreamCast – bring live radio to your site with a sleek player
≤2.4.6Update to 2.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Document Embedder – let visitors read files without downloading
≤2.5.0Update to 2.5.1
- High8.1Unauthenticated Local File Inclusion
DirectoryPress – Business Directory And Classified Ad Listing
≤3.6.27No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Before After Image Comparison – Visual Comparison for Two Images
≤1.1.21Update to 1.1.22
- Medium4.3Missing Authorization
Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration
≤3.1.0No patch available
- High8.1Unauthenticated PHP Object Injection
Splendour
≤1.23No patch available
- High8.1Unauthenticated PHP Object Injection
Stargaze
≤1.10No patch available
- High8.1Unauthenticated PHP Object Injection
tipsy
≤1.6No patch available
- High8.1Unauthenticated PHP Object Injection
Wine House | Winery & Restaurant WordPress Theme
≤3.20No patch available
- High8.1Boat Services WordPress Theme <= 2.6 - Unauthenticated PHP Object Injection
Yacht Rental - Boat Services WordPress Theme
≤2.6No patch available
- Medium5.3Missing Authorization
click5 CRM add-on to Contact Form 7
≤1.0.4No patch available
- High7.5Unauthenticated SQL Injection
Post Voting System
≤1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
SmugMug Embed
≤3.13No patch available