Database
WordPress Vulnerability Database (page 95)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
Mang Board
≤2.4.2Update to 2.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤6.1.1Update to 6.1.2
- Medium5.3Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.1Update to 5.7.2
- High7.2Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
Kubio AI Page Builder
≤2.9.2Update to 2.9.3
- Critical9.8Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response
JSON API Auth
≤3.1.2Update to 3.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.4Update to 3.6.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
GSpeech TTS – WordPress Text To Speech Plugin
≤3.22.0Update to 3.22.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
≤4.13.0Update to 4.14.0
- Medium6.1Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
Greenshift – animation and page builder blocks
≤13.2.0Update to 13.2.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'orderby' Parameter
Event Tickets and Registration
≤5.29.5Update to 5.29.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
Download Monitor
≤5.2.10Update to 5.2.11
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
Download Manager
≤3.3.70Update to 3.3.71
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
DoFollow Case by Case
≤3.6.0Update to 3.6.1
- Medium6.5Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.18Update to 5.0.19
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Customer Reviews for WooCommerce
≤5.122.0Update to 5.123.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
CMB2
≤2.13.1Update to 2.13.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
CMB2
≤2.13.0Update to 2.13.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter
BA Book Everything
≤1.8.28Update to 1.8.29
- High7.2Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.4Update to 3.15.5
- High8.1File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
Ninja Forms - File Uploads
≤3.3.34Update to 3.3.35
- High7.2Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
JetAppointment
≤2.5.2.1Update to 2.5.3
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Autoptimize
≤3.1.15.1Update to 3.1.16
- Medium6.1Reflected Cross-Site Scripting via 'lang' Parameter
Avada | Website Builder For WordPress & WooCommerce
≤7.16.1Update to 7.16.2
- High8.8Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- High7.5Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
SiteOrigin Widgets Bundle
≤1.73.2Update to 1.74.0
- Critical9.1Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- Critical9.8Unauthenticated Authentication Bypass via 'paypal_param' Parameter
Divi Membership
≤2.3.0Update to 3.0.0
- Critical9.8Unauthenticated Privilege Escalation via 'form_id' Parameter
Divi Membership
≤2.2.0Update to 2.3.0
- High7.2Authenticated (Administrator+) Remote Code Execution
CTX Feed Pro
≤7.6.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)
Visitor Traffic Real Time Statistics pro
≤11.22Update to 11.23