Database
WordPress Vulnerability Database (page 89)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.7Update to 5.2.8
- Medium4.3Missing Authorization
Advanced Partial Payment or Deposit for WooCommerce
≤4.0.1Update to 4.0.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.5Update to 10.31.6
- High7.5Unauthenticated Arbitrary File Read
Generate PDF using Contact Form 7
≤4.2.1Update to 4.2.2
- Critical9.8Unauthenticated Arbitrary File Upload
Zombify
≤1.7.7No patch available
- Medium5.3Missing Authorization
Sermon'e
≤1.0.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP User Frontend Pro
≤4.2.13No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Media folder
≤6.2.2No patch available
- High7.5Unauthenticated SQL Injection
WooCommerce Appointments
≤5.3.2No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.1Update to 9.3.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.2Update to 6.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Total Donations
≤2.0.5No patch available
- High7.5Unauthenticated SQL Injection
WooCommerce Lottery
≤2.2.9No patch available
- Medium6.1Progressive Web App (PWA) <= 1.6.0 - Unauthenticated Cross-Site Scripting
Progressify – All-in-One Progressive Web App (PWA)
≤1.6.0No patch available
- High8.1Unauthenticated PHP Object Injection
Haaken - Fashion Store WordPress Theme
≤1.5Update to 1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Payment
≤2.5.4Update to 2.5.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JetReviews
≤3.1.2Update to 3.1.2.1
- High7.5Unauthenticated Arbitrary File Read
PDF for Contact Form 7 + Drag and Drop Template Builder
≤7.1.0Update to 7.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Sharing Plugin – Sassy Social Share
≤3.3.79No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Kubio AI Page Builder
≤2.9.3Update to 2.9.4
- Medium6.1Reflected Cross-Site Scripting
Grand Restaurant WordPress
<7.0.11Update to 7.0.11
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP BASE Booking of Appointments, Services and Events
≤6.4.0Update to 6.5.0
- High7.5Authenticated (Contributor+) PHP Object Injection
VK Google Job Posting Manager
≤1.3.1Update to 1.3.2
- High7.5Authenticated (Author+) PHP Object Injection
WP Spell Check
≤12.1Update to 12.2
- High7.5Authenticated (Contributor+) PHP Object Injection
Simple Event Planner
≤1.5.7Update to 1.5.8
- High7.5Authenticated (Custom Role+) PHP Object Injection
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.7.1Update to 3.7.2
- High7.5Authenticated (Custom Role+) PHP Object Injection
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
≤3.0Update to 3.1
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
≤13.5.7Update to 13.5.8
- Medium4.3Missing Authorization
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more
≤3.0.2Update to 3.1.0
- High7.5Unauthenticated SQL Injection
WP BASE Booking of Appointments, Services and Events
≤6.4.0Update to 6.5.0