Database
WordPress Vulnerability Database (page 97)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Memberful – Membership Plugin
≤1.81.0Update to 1.81.1
- High7.2Unauthenticated Stored Cross-Site Scripting
MaxGalleria
≤6.5.3Update to 6.5.4
- Medium5.3Unauthenticated Insecure Direct Object Reference
REST API Log
≤1.7.2Update to 1.7.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.1Update to 3.13.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Parallax Section Block – Add Parallax Scrolling Effects to Sections
≤2.0.4Update to 2.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Premmerce Wishlist for WooCommerce
≤1.1.13Update to 1.1.15
- Medium5.3Missing Authorization
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤8.5.6Update to 8.5.7
- Medium5.3Missing Authorization
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
3.1.0 – 3.1.0Update to 3.1.1
- Medium6.6Authenticated (Editor+) PHP Object Injection
Hide Shipping Method For WooCommerce
≤1.5.4Update to 1.5.5
- High7.5Authenticated (Contributor+) PHP Object Injection
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
≤3.1.31Update to 3.1.44
- Medium5.3Unauthenticated Information Exposure
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤9.1Update to 9.2
- High7.5Unauthenticated SQL Injection
Iptanus File Upload
≤5.1.10Update to 5.2.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- Medium5.3Missing Authorization
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.14Update to 6.2.15
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
LA-Studio Element Kit for Elementor
≤1.6.2Update to 1.6.3
- Medium5.3Unauthenticated Information Exposure
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.0Update to 4.3.1
- Medium5.3Unauthenticated Persistent Page Denial of Service
WP Ultimate Review
≤2.4.3Update to 2.4.4
- Medium5.3Unauthenticated Information Exposure
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.4.13Update to 3.8.4.14
- Critical9.1Unauthenticated Arbitrary File Deletion
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.0.5Update to 11.1.0
- Medium4.3Authenticated (Translator+) Limited File Read
Loco Translate
≤2.8.8Update to 2.8.9
- Medium6.52.0.20 - Authenticated (Subscriber+) SQL Injection
Unlimited Elements for Elementor
1.5.142 – 2.0.20Update to 2.0.21
- Medium5.3Unauthenticated Privileged POS Session Hijacking
TillKit – Mobile POS for WooCommerce
≤1.0.4Update to 1.0.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Kubio AI Page Builder
≤2.9.2Update to 2.9.3
- Medium5.34.3.0 - Unauthenticated Information Exposure
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
2.2.1 – 4.3.0Update to 4.3.1
- High7.52.0.20 - Unauthenticated SQL Injection
Unlimited Elements for Elementor
1.5.139 – 2.0.20Update to 2.0.21
- Medium5.3Unauthenticated Information Exposure
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤9.1Update to 9.2
- Medium4.9Authenticated (Editor+) Arbitrary File Read
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.2Update to 4.2.3
- High7.1Authenticated (Admin+) Arbitrary Directory Deletion
Prime Mover – Backup and Migration
≤2.2.0Update to 2.2.1
- Medium5.3Unauthenticated Persistent Denial of Service
WP Ultimate Review
≤2.4.3Update to 2.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Ultimate Review
≤2.4.3Update to 2.4.4