Database
WordPress Vulnerability Database (page 85)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
Piotnet Addons For Elementor
≤7.1.71No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Appointment Bookings for Zoom GoogleMeet and more – Wappointment
≤2.7.7No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
WP Duplicate – WordPress Migration Plugin
≤1.1.11No patch available
- High7.3Unauthenticated Privilege Escalation
Taskbot
≤6.6No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Taskbot
≤6.6No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Midtrans-WooCommerce
≤2.32.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Mapster WP Maps
≤2.0.4Update to 2.0.5
- Medium4.3Authenticated (Contributor+) Information Exposure
Polylang
≤3.8.7Update to 3.8.8
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- Medium5.3Unauthenticated Information Exposure
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.8.3Update to 4.9
- Medium5.3Unauthenticated Information Exposure
XServer Migrator
≤1.6.6Update to 1.6.7
- Medium5.3Unauthenticated Information Exposure
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- High7.3Unauthenticated Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤4.0.0Update to 4.0.1
- Medium5.3Unauthenticated Information Exposure
Motors – Car Dealership & Classified Listings Plugin
≤1.4.124Update to 1.4.125
- High7.2Unauthenticated Stored Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.12.3Update to 1.8.13
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- High7.2Unauthenticated Stored Cross-Site Scripting
picu – Online Photo Proofing Gallery
≤3.10.1Update to 3.10.2
- Medium5.3Missing Authorization
picu – Online Photo Proofing Gallery
≤3.10.1Update to 3.10.2
- High7.3Unauthenticated Privilege Escalation
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.1.1Update to 3.1.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WP User Profiles
≤2.7.3Update to 2.7.4
- Medium5.3Missing Authorization
PowerPress Podcasting plugin by Blubrry
≤11.17.9Update to 11.17.11
- Medium4.3Missing Authorization
WP Dummy Content Generator
≤4.0.0No patch available
- High7.3Unauthenticated Privilege Escalation
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.7Update to 10.31.9
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Mailster
≤1.9.0.0Update to 1.9.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Block
≤1.8.1Update to 1.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.9Update to 4.4.9.1
- Medium4.7Authenticated (Editor+) Privilege Escalation
Import and export users and customers
≤2.5.5Update to 2.5.7
- Medium5.3Unauthenticated Information Exposure
SiteVault – Backup, Restore, Migration & Cloning
≤1.5.17Update to 1.5.18
- Medium4.3Missing Authorization
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤44.1Update to 45.0