Database
WordPress Vulnerability Database (page 96)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow
DevKit Pro
≤2.3.0Update to 2.3.1
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.1Update to 2.14.0
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Critical9.8Unauthenticated Remote Code Execution
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
ByteCoreStack – MCP Connector for AI Tools
≤1.2.2Update to 1.2.4
- High7.3Unauthenticated Privilege Escalation
Authorizer
≤3.15.3Update to 3.16.0
- Medium4.3Missing Authorization
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
≤4.0.7Update to 4.1.0
- Medium4.3Missing Authorization
Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more
≤3.6.2Update to 3.7.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Bus Ticket Booking with Seat Reservation
≤5.9.3Update to 5.9.4
- Medium4.3Missing Authorization
Aruba Migration Tool
≤1.0.4Update to 1.0.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Premmerce Wishlist for WooCommerce
≤1.1.13Update to 1.1.15
- Medium5.3Unauthenticated Information Exposure
CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)
≤3.7.2Update to 3.8.0
- Medium4.9Authenticated (Editor+) SQL Injection
Captivate Sync
≤3.3.2Update to 3.3.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.1Update to 2.14.0
- Medium4.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.1Update to 2.3.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
ProfileGrid – User Profiles, Groups and Communities
≤6.0.0.2Update to 6.0.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.4Update to 6.8.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.0Update to 4.3.1
- Medium5.3Unauthenticated Information Exposure
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.4.13Update to 3.8.4.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.6Update to 4.0.7
- Medium6.5Authenticated (Contributor+) SQL Injection
BuildKit – Product Builder for WooCommerce – Custom PC Builder
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤4.0.6Update to 4.0.7
- Medium5.3Missing Authorization
AFFI – Affiliate Marketing for WooCommerce
≤1.0.9Update to 1.0.10
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.0Update to 1.2.1
- Medium5.3Missing Authorization
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.0Update to 1.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.14Update to 6.2.15
- Medium4.3Missing Authorization
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program
≤4.6.3Update to 4.6.4
- Medium5.3Missing Authorization
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium5.3Missing Authorization
Site Reviews
≤8.3.2Update to 8.3.3
- Medium6.5Authenticated (Contributor+) SQL Injection
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21