Database
WordPress Vulnerability Database (page 86)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments
≤7.1Update to 7.2
- Medium4.3Missing Authorization
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤4.7.7Update to 4.7.8
- Medium6.5Authenticated (Contributor+) SQL Injection
Image Optimizer, Resizer and CDN – Sirv
≤8.2.5Update to 8.2.6
- Medium5.3Unauthenticated Information Exposure
PowerPress Podcasting plugin by Blubrry
≤11.17.9Update to 11.17.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤4.7.7Update to 4.7.8
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
JS Help Desk – AI-Powered Support & Ticketing System
≤4.0.0Update to 5.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Name Directory
≤1.34.2Update to 1.34.3
- Medium4.3Missing Authorization
Event Tickets and Registration
≤5.30.0Update to 5.30.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Presto Player
≤4.5.2Update to 4.5.3
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Name Directory
≤1.34.2Update to 1.34.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.109Update to 4.11.110
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Logo Showcase – Logo Slider, Logo Carousel & Client Logos Grid
≤4.0.4Update to 4.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.14.2Update to 5.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
eCommerce Product Catalog
≤3.6.2Update to 3.6.3
- Medium6.5Authenticated (Custom Role+) SQL Injection
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.8.3Update to 4.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Video Conferencing with Zoom
≤4.6.10Update to 4.6.11
- Medium4.3Missing Authorization
WP Mailster
≤1.9.0.0Update to 1.9.1.0
- Medium4.3Missing Authorization
WP Admin Audit
≤1.2.17Update to 1.2.18
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
JS Help Desk – AI-Powered Support & Ticketing System
≤4.0.0Update to 5.0.0
- Medium4.3Cross-Site Request Forgery
PowerPress Podcasting plugin by Blubrry
≤11.17.9Update to 11.17.11
- Medium4.3Missing Authorization
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
≤9.1.3Update to 9.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
QR Redirector
≤2.0.5Update to 2.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- Medium5.3Unauthenticated Information Exposure
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.5Update to 7.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
bBlocks – Essential Gutenberg Blocks & Patterns Collection
≤2.1.8Update to 2.1.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
≤3.6.13Update to 3.6.14
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.0.0Update to 4.0.0
- Medium5.3Unauthenticated Mail Relay
Magee Shortcodes
≤2.1.1No patch available
- Critical9.8Unauthenticated Privilege Escalation
Tourfic Pro
≤1.17.3No patch available
- Medium5.37.6.2 - Missing Authorization
Nexi XPay Build
7.0.0 – 7.6.2No patch available