Database
WordPress Vulnerability Database (page 91)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection
tagDiv Opt-In Builder
≤1.7.6Update to 1.7.7
- High7.5Pay Writer <= 12.0.1 - Unauthenticated SQL Injection
JNews - Pay Writer
≤12.0.1Update to 12.0.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤6.0.5Update to 6.0.6
- Medium5.3Missing Authorization to Unauthenticated Settings Update
워드프레스 결제 심플페이 – 우커머스 결제 플러그인
≤5.5.17Update to 5.5.18
- High7.2Unauthenticated Stored Cross-Site Scripting
VikBooking Hotel Booking Engine & PMS
≤1.8.14Update to 1.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
JetBlog
≤2.4.10Update to 2.4.10.1
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Pay with Vipps and MobilePay for WooCommerce
≤6.2.0Update to 6.2.1
- Medium4.3Missing Authorization
File Media Renamer
≤1.3No patch available
- Medium4.3Cross-Site Request Forgery
Wallstreet
≤2.8.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
Twenty20 Image Before-After
≤2.0.5Update to 2.0.6
- Critical9.1Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.11.0.5Update to 2.11.0.6
- Medium4.3Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
≤3.7.1Update to 3.7.2
- High8.1Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
Nelio Content – Editorial Calendar & Social Media Auto-Posting
≤4.5.0Update to 4.5.1
- Medium6.1Reflected Cross-Site Scripting via 'thumb_url' Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.46Update to 1.8.47
- Medium6.1Reflected Cross-Site Scripting via REQUEST_URI
WPFront Notification Bar
≤3.5.1Update to 3.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
WPC Product Options for WooCommerce
≤4.0.5Update to 4.0.6
- Medium6.1Reflected Cross-Site Scripting via 'rule_data' Parameter
WPC Estimated Delivery Date for WooCommerce
≤4.0.1Update to 4.0.2
- Medium5.4Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
WPMobile.App – Android and iOS App Builder
≤11.84Update to 11.85
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
WP Ultimate Review
≤2.4.3Update to 2.4.4
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
WP Ultimate Review
≤2.4.3Update to 2.4.4
- High7.5Unauthenticated SQL Injection via 'fullRef' Parameter
WP Visitor Statistics (Real Time Traffic)
≤8.7Update to 8.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
Mail logging & Catcher
≤2.1.12Update to 2.2.0
- High7.5Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.18Update to 3.0.19
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.19Update to 3.0.20
- Critical9.1Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
VikAppointments Services Booking Calendar
≤1.2.21Update to 1.2.22
- High8.8Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)
≤8.97.0Update to 8.98.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Responsive Starter Templates – Elementor Templates & Starter Sites
≤3.5.3Update to 3.5.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
Wp Social Login and Register Social Counter
≤3.2.1Update to 3.2.2
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter
SEOPress – AI SEO Plugin & On-site SEO
≤10.2Update to 10.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Author Display Name
SEOPress – AI SEO Plugin & On-site SEO
≤10.2Update to 10.3