Database
WordPress Vulnerability Database (page 98)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.52.0.20 - Unauthenticated SQL Injection
Unlimited Elements for Elementor
1.5.139 – 2.0.20Update to 2.0.21
- Medium5.3Unauthenticated Information Exposure
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤9.1Update to 9.2
- Medium4.9Authenticated (Editor+) Arbitrary File Read
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.2Update to 4.2.3
- High7.1Authenticated (Admin+) Arbitrary Directory Deletion
Prime Mover – Backup and Migration
≤2.2.0Update to 2.2.1
- Medium5.3Unauthenticated Persistent Denial of Service
WP Ultimate Review
≤2.4.3Update to 2.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Ultimate Review
≤2.4.3Update to 2.4.4
- Medium5.3Missing Authorization
Mailchimp for WooCommerce
≤6.2Update to 6.3
- Medium6.4Authenticated (Translator+) Stored Cross-Site Scripting
Loco Translate
≤2.8.8Update to 2.8.9
- High7.5Unauthenticated SQL Injection
SaveTo Wishlist Lite – WooCommerce Wishlist
≤1.1.4Update to 1.1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kubio AI Page Builder
≤2.9.2Update to 2.9.3
- Medium4.7Unauthenticated Arbitrary HTML Injection in Notification Emails
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.0Update to 4.3.1
- High7.2Authenticated (Admin+) Arbitrary File Write
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium4.49.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
7.17 – 9.1Update to 9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Horizontal scrolling announcements
≤2.6No patch available
- Medium4.3Unauthenticated Two-Factor Authentication Bypass
WP 2FA – Two-factor authentication for WordPress
≤4.0.0Update to 4.1.0
- High7.3Unauthenticated Captcha Verification Bypass
hCaptcha for WP
≤5.3.0Update to 5.4.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Prime Mover – Backup and Migration
≤2.2.0Update to 2.2.1
- High8.8Authenticated (Admin+) Arbitrary File Upload
Prime Mover – Backup and Migration
≤2.2.0Update to 2.2.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Ultimate Review
≤2.4.3Update to 2.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2Update to 1.57.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤6.4.5Update to 6.4.6
- Medium6.1Reflected Cross-Site Scripting via 's' Search Parameter
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- High7.2Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2Update to 1.57.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
PDF Invoices & Packing Slips for WooCommerce
≤5.16.1Update to 5.16.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
Business Essentials for Contact Form 7
≤1.2.1Update to 1.2.2
- High8.1Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- Medium4.7Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.3Update to 5.5.1.4
- Medium6.1Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.3Update to 5.5.1.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
bbp style pack
≤6.4.8Update to 6.4.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.4.0Update to 6.4.1