Database
WordPress Vulnerability Database (page 89)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Arbitrary File Upload
Kognetiks Chatbot
≤2.4.9Update to 2.5.0
- High7.2Unauthenticated Server-Side Request Forgery
PDF Smart Viewer for Elementor
≤1.0.4No patch available
- Medium4.3Missing Authorization
Progress Planner
≤1.10.0Update to 1.10.1
- Medium5.3Missing Authorization
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.2.2Update to 1.2.3
- Medium6.1Reflected Cross-Site Scripting
Payflex Payment Gateway
≤2.7.1Update to 2.8.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
ProfileGrid – User Profiles, Groups and Communities
≤6.0.0.2Update to 6.0.0.3
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.7Update to 5.2.8
- Medium4.3Missing Authorization
Advanced Partial Payment or Deposit for WooCommerce
≤4.0.1Update to 4.0.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.5Update to 10.31.6
- High7.5Unauthenticated Arbitrary File Read
Generate PDF using Contact Form 7
≤4.2.1Update to 4.2.2
- Critical9.8Unauthenticated Arbitrary File Upload
Zombify
≤1.7.7No patch available
- Medium5.3Missing Authorization
Sermon'e
≤1.0.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP User Frontend Pro
≤4.2.13No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Media folder
≤6.2.2No patch available
- High7.5Unauthenticated SQL Injection
WooCommerce Appointments
≤5.3.2No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.1Update to 9.3.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.2Update to 6.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Total Donations
≤2.0.5No patch available
- High7.5Unauthenticated SQL Injection
WooCommerce Lottery
≤2.2.9No patch available
- Medium6.1Progressive Web App (PWA) <= 1.6.0 - Unauthenticated Cross-Site Scripting
Progressify – All-in-One Progressive Web App (PWA)
≤1.6.0No patch available
- High8.1Unauthenticated PHP Object Injection
Haaken - Fashion Store WordPress Theme
≤1.5Update to 1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Payment
≤2.5.4Update to 2.5.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JetReviews
≤3.1.2Update to 3.1.2.1
- High7.5Unauthenticated Arbitrary File Read
PDF for Contact Form 7 + Drag and Drop Template Builder
≤7.1.0Update to 7.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Sharing Plugin – Sassy Social Share
≤3.3.79No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Kubio AI Page Builder
≤2.9.3Update to 2.9.4
- Medium6.1Reflected Cross-Site Scripting
Grand Restaurant WordPress
<7.0.11Update to 7.0.11
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP BASE Booking of Appointments, Services and Events
≤6.4.0Update to 6.5.0
- High7.5Authenticated (Contributor+) PHP Object Injection
VK Google Job Posting Manager
≤1.3.1Update to 1.3.2
- High7.5Authenticated (Author+) PHP Object Injection
WP Spell Check
≤12.1Update to 12.2