Database
WordPress Vulnerability Database (page 92)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
WPC Smart Quick View for WooCommerce
≤4.4.0Update to 4.4.1
- High8.1Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)
Rich Showcase for Google Reviews
≤7.1.3Update to 7.1.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header
Visitor Traffic Real Time Statistics
≤8.16Update to 8.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget
Ultra Addons Lite for Elementor
≤1.3.2Update to 1.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
Welcart e-Commerce
≤2.12.2Update to 2.12.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter
Helpdesk Support Ticket System for WooCommerce
≤2.1.6Update to 2.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
Strong Testimonials
≤3.3.11Update to 3.3.12
- Medium5.3Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…
WPZOOM Connect: Social Icons Widget & Block, Share Buttons & Click to Chat
≤4.7.3Update to 4.7.4
- High7.5Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
Simple Membership
≤4.8.3Update to 4.8.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder
Transliterator – Multilingual and Multi-script Text Conversion
≤2.5.8Update to 2.5.9
- High7.2Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author
Magic Tooltips For Contact Form 7
≤1.0.34Update to 1.0.35
- High7.5Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.186Update to 2.8.187
- Medium6.1Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.5Update to 5.5.1.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action
Alt Text AI – Automatically generate image alt text for SEO and accessibility
≤1.10.41Update to 1.10.42
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤5.0.2Update to 5.0.2.1
- Medium4.3Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤4.0.1Update to 4.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
≤5.3.5Update to 5.3.6
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium4.3Authenticated (Subscriber+) Information Exposure
Mindio Magic MCP
≤0.5.6Update to 0.7.1
- High8.8Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9Update to 4.9.1
- Medium4.3Missing Authorization
WDS MCP Content Manager
≤3.10.4No patch available
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Issues and Series for Newspapers, Magazines, Publishers, Writers
≤3.1.3Update to 3.1.4
- Medium4.3Missing Authorization
WebSamurai
≤1.0.7No patch available
- Medium4.3Missing Authorization
Airano MCP Bridge
≤2.11.0No patch available
- Medium5.3Unauthenticated Information Exposure
Smart One Click Setup – Complete Demo Import & Export
≤1.4.3No patch available
- Medium6.1Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.7Update to 4.4.8
- Medium6.1Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.4Update to 4.17.5
- High8.8Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.4Update to 4.17.5
- Medium6.1Reflected Cross-Site Scripting via REQUEST_URI Parameter Key
EWWW Image Optimizer
≤8.7.7Update to 8.8.0