Database
WordPress Vulnerability Database (page 84)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Blog, Posts and Category Filter for Elementor
≤2.1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
CF7 Views – Complete Entry Management for Contact Form 7
≤3.2.6No patch available
- High7.5Unauthenticated SQL Injection
Newsletter Subscription Form – User Subscriptions Form, Capture Email
≤1.5.9No patch available
- Medium5.3Unauthenticated Information Exposure
SafeSnap – Verified WordPress Backup & Restore
≤2.1.2No patch available
- Medium5.3Missing Authorization
WXD Backup Lite
≤1.0.2No patch available
- Medium5.3Unauthenticated Information Exposure
Museder RestoreOne
≤2.7.277Update to 2.7.278
- Medium5.3Unauthenticated Information Exposure
Norvis Backup
≤1.1.0No patch available
- Medium5.3Unauthenticated Information Exposure
Sitemovr
≤1.0.1No patch available
- Medium5.3Unauthenticated Information Exposure
Snapshotify – All-in-One Backup & Restore & Migrate
≤1.3.6Update to 1.3.7
- Medium5.3Missing Authorization
Fluent Booking Pro
<2.5.0Update to 2.5.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden
≤3.5.7No patch available
- Medium4.3Missing Authorization
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden
≤3.5.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
≤2.0.6Update to 2.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.5No patch available
- High7.3Unauthenticated Privilege Escalation
Meta Box AIO
≤3.7.1No patch available
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- Medium5.3Missing Authorization
Kit (formerly ConvertKit) for WooCommerce
≤2.2.0Update to 2.2.1
- Medium5.3Missing Authorization
Morning for WooCommerce
≤2.4.1Update to 2.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
HTTP Requests Manager
≤1.3.11Update to 1.3.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Database for CF7
≤1.2.6No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WC Fields Factory
≤4.1.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Designer for WooCommerce WordPress | Lumise
≤2.1.1No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Instapage Plugin
≤3.7.2Update to 3.7.3
- Medium5.3Unauthenticated Information Exposure
Edwiser Bridge – WordPress Moodle Integration
≤4.3.4No patch available
- Medium4.3Missing Authorization
Wise Chat
≤3.4.3Update to 3.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.7.6No patch available
- High7.5Unauthenticated SQL Injection
Booknetic
≤4.8.5No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Woffice CRM
≤5.4.35No patch available
- Medium4.3Missing Authorization
App for Cloudflare®
≤1.10.1No patch available
- Medium5.3Missing Authorization
PayPlug for WooCommerce (Official)
≤3.1.0Update to 3.1.1