Database
WordPress Vulnerability Database (page 71)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Unauthenticated Privilege Escalation
AI Content Generator Marketing
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
click5 CRM add-on to WPForms
≤1.0.3No patch available
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Hotel Booking
≤3.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
≤2.8.8No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
Angio - Creative Music Theme
≤1.1.1No patch available
- Medium4.3Authenticated (Vendor+) Information Exposure
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.1.0Update to 5.2.0
- Medium5.3Unauthenticated Arbitrary Order Payment Bypass
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway
≤1.7.2Update to 1.7.3
- Medium4.3Authenticated (Author+) Information Exposure
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Medium5.4Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤4.0.3Update to 4.0.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Veeqo for WooCommerce
≤2.2.8No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
paymendo – Bank Transfer (Lite)
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
Loja Automática
≤1.0.0No patch available
- High7.5Unauthenticated SQL Injection
Recordbrowser
≤1.1.7No patch available
- High7.5Unauthenticated SQL Injection
Site Setup Wizard
≤1.5.8No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
KeyWord Collector
≤1.4No patch available
- Medium4.3Disabled Account Authorization Bypass
Disable Users
≤1.0.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
BuddyPress Instant Chat
≤1.6No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Adwised Web Push Notification
≤2.5.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
HootBoard – Bulletin Board For Your Organization & Team Communication
≤3.1.4No patch available
- Medium5.3Missing Authorization
Insurify – Order & Shipping Protection
≤1.0No patch available
- Medium5.3Missing Authorization
Quick quotes – WPSHARE247
≤1.0.0No patch available
- Medium5.3Missing Authorization
Insurify – Order & Shipping Protection
≤1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
click5 CRM add-on to Gravity Forms
≤1.0.3No patch available
- Medium5.3Missing Authorization
click5 CRM add-on to WPForms
≤1.0.3No patch available
- Medium5.3Missing Authorization
click5 CRM add-on to Ninja Forms
≤1.0.1No patch available
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium4.3Cross-Site Request Forgery
Hotel Booking
≤3.8No patch available
- Medium5.3Missing Authorization
Fundiin cho WooCommerce
≤3.4.0No patch available
- High7.5Unauthenticated SQL Injection
Tcard WP
≤1.8.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6