Database
WordPress Vulnerability Database (page 88)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Fluent Forms Pro Add On Pack
≤6.2.13Update to 6.2.14
- Medium6.11.10.1 - Reflected Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.4.4 – 1.10.1Update to 1.10.2
- Medium5.3Missing Authorization to Unauthenticated Settings Change
PayPlug for WooCommerce (Official)
≤3.1.0Update to 3.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
WooCommerce Simple Auctions
≤3.0.10No patch available
- High7.5Functionality <= 3.9.3 - Unauthenticated SQL Injection
Porto Theme - Functionality
≤3.9.3No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion
Simple File List
≤6.3.11No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
BuddyBoss Platform
≤3.1.0No patch available
- High8.8Authenticated (Employer / Sales Representative+) Arbitrary File Upload
Workreap Core
≤3.4.5No patch available
- Medium6.1Professional LMS Education Center WordPress Theme <= 4.5.3 - Reflected Cross-Site Scripting
EduMall - Professional LMS Education Center WordPress Theme
≤4.5.3No patch available
- Medium6.1Reflected Cross-Site Scripting
WPLMS Learning Management System for WordPress, WordPress LMS
≤4.972No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Builderius – Landing Page Builder + Dynamic Templates
≤1.4-betaUpdate to 1.5-rc1
- Medium6.4Authenticated (Instructor+) Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.9.1Update to 4.4.10
- Medium5.3Unauthenticated Spam Protection Bypass on Login
Zero Spam for WordPress
≤5.7.11Update to 5.7.12
- Medium4.9Authenticated (Editor+) SQL Injection
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.2Update to 4.2.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.0Update to 1.16.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Yaad Sarig Payment Gateway For WC
≤2.2.12Update to 2.2.13
- High8.8Authenticated (Subscriber+) Remote Code Execution
WooCommerce Designer Pro
≤1.9.33No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Ohio Extra
≤3.6.8No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Mooberry Book Manager
4.16.2 – 4.16.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Smart Forms – when you need more than just a contact form
≤2.6.104No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Frontend File Manager Plugin
≤23.6No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
SUMO Affiliates Pro
≤11.7.0No patch available
- Medium4.3Authenticated (Customer+) Insecure Direct Object Reference
Faktur Pro for WooCommerce
≤3.2.2Update to 3.2.3
- Medium4.3Missing Authorization
ECPay Ecommerce for WooCommerce
≤1.1.2606090Update to 1.1.2610150
- Critical9.8Unauthenticated Arbitrary File Upload
Kognetiks Chatbot
≤2.4.9Update to 2.5.0
- High7.2Unauthenticated Server-Side Request Forgery
PDF Smart Viewer for Elementor
≤1.0.4No patch available
- Medium4.3Missing Authorization
Progress Planner
≤1.10.0Update to 1.10.1
- Medium5.3Missing Authorization
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.2.2Update to 1.2.3
- Medium6.1Reflected Cross-Site Scripting
Payflex Payment Gateway
≤2.7.1Update to 2.8.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
ProfileGrid – User Profiles, Groups and Communities
≤6.0.0.2Update to 6.0.0.3