Database
WordPress Vulnerability Database (page 82)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
Travel Booking WordPress Theme
≤3.2.9Update to 3.3
- Medium5.3Missing Authorization
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- Medium5.31.19.8 - Missing Authorization
Shipping for Nova Poshta
1.18.7 – 1.19.8No patch available
- Medium5.3Missing Authorization
UnitechPay – Wave & Orange Money Payments
≤1.0.6.3No patch available
- Medium4.31.7.1 - Cross-Site Request Forgery
GDPR Data Request Form
1.5 – 1.7.1Update to 1.8
- High7.2Unauthenticated Stored Cross-Site Scripting
FV Player 8
≤8.1.8Update to 8.1.9
- Medium5.3Unauthenticated Information Exposure
Swish Migrate and Backup
≤1.4.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Share Icons & Social Share Buttons
≤3.7.5Update to 3.7.6
- Medium5.3Unauthenticated Information Exposure
Web Plura Backup & Restore – Local Backups, Restore & Recovery
≤0.2.25No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Jotform – AI Chatbot
≤3.8.3Update to 3.8.4
- Medium4.3Missing Authorization
Wordable – Export Google Docs to WordPress
≤8.2.10No patch available
- Medium4.3Missing Authorization
wpsection
≤1.5.1No patch available
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
AI Copilot – Content Generator
≤1.5.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
≤3.6.13Update to 3.6.14
- High7.3Unauthenticated Arbitrary Account Takeover
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
≤2.16.0Update to 2.17.0
- Medium5.3Unauthenticated Payment Bypass
Airwallex Online Payments Gateway
≤1.35.0Update to 1.36.0
- Medium6.1Reflected Cross-Site Scripting
Gloria Admin Panel
≤1.3No patch available
- Medium6.32.7.10 - Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
2.0.0 – 2.7.10Update to 2.8.0
- Medium4.3Missing Authorization
SendPress Newsletters
≤1.26.1.20No patch available
- High7.51.0.8 - Unauthenticated SQL Injection
Testimonials by BestWebSoft
1.0.5 – 1.0.8No patch available
- Medium5.3Missing Authorization
SKU Error Fixer for WooCommerce
≤1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.5.54.7212Update to 7.5.55.7212
- High7.2Unauthenticated Stored Cross-Site Scripting
Qode Real Estate
≤1.1.7.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Qode Music
≤2.1.8.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
≤2.17.0Update to 2.18.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)
≤1.5.3Update to 1.5.4
- Critical9.8Unauthenticated Remote Code Execution
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin
≤2.3.13Update to 2.3.14
- High8.1Unauthenticated PHP Object Injection
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
≤6.2.1Update to 6.2.2
- Medium5.3Unauthenticated Unauthorized Account Creation
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.0Update to 3.7.1