Database
WordPress Vulnerability Database (page 90)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Contributor+) PHP Object Injection
Advanced Post Manager
≤4.5.5Update to 4.5.6
- Medium4.3Authenticated (Subscriber+) Information Exposure
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1226Update to 4.1227
- Medium5.3Unauthenticated Insecure Direct Object Reference
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.23Update to 2.2.24
- Medium5.3Unauthenticated Insecure Direct Object Reference
Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT
≤2.0.2Update to 2.0.3
- Medium5.3Unauthenticated Information Exposure
Five Star Restaurant Reservations – WordPress Booking Plugin
≤2.7.24Update to 2.8.0
- Medium5.3Missing Authorization
Timetics – Appointment Booking Calendar & Scheduling
≤1.0.63Update to 1.0.64
- Medium6.1Reflected Cross-Site Scripting
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- High7.3Unauthenticated Privilege Escalation
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.20Update to 2.9.21
- Medium4.3Missing Authorization
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.74Update to 1.2.76
- Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1225Update to 4.1227
- Medium5.3Missing Authorization
Lookzy LookBook for WooCommerce
≤1.1.14Update to 1.1.15
- Medium5.3Missing Authorization
Fast Courier – Shipping & Freight
≤5.2.3No patch available
- Medium5.3Unauthenticated Cart Data Manipulation
BuildKit – Product Builder for WooCommerce – Custom PC Builder
≤1.0.28Update to 1.0.29
- High7.5Unauthenticated SQL Injection
EduAdmin Booking
<6.0.0Update to 6.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Welcart e-Commerce
≤2.12.3Update to 2.12.4
- High7.5Unauthenticated SQL Injection
Ajax Search Pro
≤4.29.1Update to 4.29.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
tagDiv Opt-In Builder
≤1.7.6Update to 1.7.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Media Library Assistant
≤3.41Update to 3.42
- High7.2Unauthenticated Stored Cross-Site Scripting
Search in Place
≤1.5.5Update to 1.5.6
- High7.2Unauthenticated Stored Cross-Site Scripting
ShopBuilder – WooCommerce Builder For Elementor
≤3.4.1Update to 3.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.73Update to 1.2.74
- High7.2Unauthenticated Stored Cross-Site Scripting
BlockStrap Page Builder – Bootstrap Blocks
≤0.1.58Update to 0.1.59
- High7.2Unauthenticated Stored Cross-Site Scripting
Betheme
≤28.5.8No patch available
- Medium5.3Missing Authorization
elegro Crypto Payment
≤1.0.1No patch available
- Medium5.3Unauthenticated Payment Bypass
Deema Payment Gateway
≤1.1.2No patch available
- Medium5.3Unauthenticated Payment Bypass
Deema Payment Gateway
≤1.1.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
UpSolution Core
≤8.44No patch available
- Medium5.3Unauthenticated Information Exposure
Slider Pro
≤1.0.0No patch available
- Medium4.3Missing Authorization
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.2Update to 1.23.3
- Medium4.3Cross-Site Request Forgery
Featured Image from URL (FIFU)
≤6.0.7Update to 6.0.8