Database
WordPress Vulnerability Database (page 87)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Information Exposure
User Private Files – Secure File Sharing and Client Portal Plugin
≤2.1.8Update to 2.1.9
- Medium4.34.2.14 - Authenticated (Subscriber+) Information Exposure
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
4.0.0 – 4.2.14Update to 4.2.15
- Medium5.3Missing Authorization
Fluent Forms Pro Add On Pack
≤6.2.13Update to 6.2.14
- Medium6.31.1.4 - Authenticated (Subscriber+) Privilege Escalation
Koinonia Link
1.1.2 – 1.1.4Update to 1.1.5
- Medium5.3Unauthenticated Information Exposure
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.20Update to 3.0.21
- Medium5.37.6.2 - Unauthenticated Payment Bypass
Nexi XPay Build
7.2.2 – 7.6.2No patch available
- Medium5.3Unauthenticated Login Protection Bypass
Advanced Google reCAPTCHA
≤5.40Update to 5.41
- Medium4.32-Factor Authentication Bypass
WP Synchro – The Ultimate WordPress Migration Tool
≤1.16.1Update to 1.16.2
- Medium5.3Missing Authorization to Unauthenticated Settings Update
TrueBooker – Appointment Booking and Scheduler System
≤1.2.9Update to 1.3.0
- Medium4.3Missing Authorization
Simple JWT Login – Allows you to use JWT on REST endpoints.
4.0.0 – 4.0.0No patch available
- Medium5.3Missing Authorization
Fluent Affiliate Pro
≤1.6.4Update to 1.6.5
- Medium5.3Missing Authorization
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms
≤5.2.8No patch available
- Medium5.3Missing Authorization
Graphina – Charts and Graphs For Elementor
≤3.1.12Update to 3.1.13
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Job Postings
≤2.8.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Magee Shortcodes
≤2.1.1No patch available
- Medium4.3Missing Authorization
Unlimited Elements for Elementor
≤2.0.22Update to 2.0.23
- Medium4.3Missing Authorization
CP Media Player – Audio Player and Video Player
≤1.3.3Update to 1.3.4
- High7.24.5.1 - Authenticated (Editor+) Remote Code Execution
WP Coder – Insert & Manage Code Snippets
4.0 – 4.5.1Update to 4.5.2
- Medium4.9Authenticated (Editor+) SQL Injection
Animated Number Counters
≤3.0Update to 3.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.0Update to 1.16.1
- Medium4.3Authenticated (Contributor+) Protected Post Content Disclosure
Memberful – Membership Plugin
≤1.81.2Update to 1.82.0
- Medium5.33.1.0 - Unauthenticated Information Exposure
Geliver Akıllı Kargo Pazaryeri
3.0.0 – 3.1.0Update to 3.1.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.0.0Update to 4.0.0
- Medium4.3Missing Authorization
Frontend Dashboard
≤2.0.0Update to 3.0.0
- Medium5.3Missing Authroization
E-cab Taxi Booking Manager for Woocommerce
≤2.1.1Update to 2.1.2
- Medium5.34.11.1 - Missing Authorization
Integration for Epos Now and WooCommerce
4.6.0 – 4.11.1Update to 4.11.2
- Medium6.411.17.9 - Authenticated (Contributor+) Server-Side Request Forgery
PowerPress Podcasting plugin by Blubrry
11.13.12 – 11.17.9Update to 11.17.11
- Medium5.3Unauthenticated Login Lockout Protection Bypass
Login Lockdown & Protection
≤2.17Update to 2.18
- High8.1Unauthenticated PHP Object Injection
String locator
≤2.6.7Update to 2.6.8
- Medium5.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.2.17Update to 2.2.18