Database
WordPress Vulnerability Database (page 1092)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Missing Authorization via '_tool_history_delete'
Betheme
≤27.1.1Update to 27.1.2
- Medium6.1Reflected Cross-Site Scripting
Business Pro
≤1.10.4No patch available
- High8.8Authenticated (Subscriber+) SQL Injection
Avada (Fusion) Builder
≤3.11.1Update to 3.11.2
- Medium4.46.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Advanced Custom Fields Pro
6.1 – 6.1.7Update to 6.1.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Online Booking & Scheduling Calendar by vcita
≤4.3.2Update to 4.3.3
- High7.2Authenticated (Administrator+) Arbitrary File Upload
Theme Demo Import
≤1.1.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
EmbedPress
≤3.8.2Update to 3.8.3
- Critical9.8Unauthenticated Remote File Inclusion
Canto
≤3.0.4Update to 3.0.5
- Critical9.8Unauthenticated Arbitrary File Upload
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
<3.1.11Update to 3.1.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WxSync-标准云微信公众号文章免费采集-任意公众号自动采集付费购买
≤2.8.0Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
BigBlueButton
≤3.0.0-beta.4No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
wsecure lite
≤2.5Update to 3.0
- High8.8Cross-Site Request Forgery to User Email Change
Realia
≤1.4.0No patch available
- High8.8Cross-Site Request Forgery to User Email/Password Change
Absolute Privacy
≤2.1No patch available
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data
EmbedPress
≤3.8.2Update to 3.8.3
- Medium5.3Missing Authorization to Initial Page Creation
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<3.9.8Update to 3.9.8
- High8.8Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation
FULL – Cliente
≤2.2.3Update to 2.3
- High7.5Unauthenticated Data Export to Sensitive Information Disclosure
User Activity Log
≤1.6.5Update to 1.6.6
- High8.8Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
Real Estate Manager – Property Listing and Agent Management
≤7.2No patch available
- Medium4.3Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check
FULL – Cliente
≤2.2.3Update to 2.3
- Medium4.3Courses for Membership Add On <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Course Modifications
Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS
<1.2.4Update to 1.2.4
- Critical9.8Unauthenticated Privilege Escalation
Biometric Login For WooCommerce
≤1.0.3Update to 1.0.4
- Medium6.6Authenticated (Administrator+) PHP Object Injection
Weaver Show Posts
≤1.8.0Update to 1.8.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Modification
JCH Optimize
<4.0.1Update to 4.0.1
- Medium4.4Courses for Membership Add On <= 1.2.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS
<1.2.5Update to 1.2.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.7.7Update to 4.7.8
- Medium4.3Cross-Site Request Forgery
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.6.8Update to 2.6.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.7.7Update to 4.7.8
- Medium4.3Courses for Membership Add On <= 1.2.3 - Cross-Site Request Forgery to Course Modifications
Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS
<1.2.4Update to 1.2.4
- Critical9.8Unauthenticated PHP Object Injection
Themesflat Addons For Elementor
≤2.0.0Update to 2.0.1