Database
WordPress Vulnerability Database (page 1331)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Directory Traversal to Remote Code Execution
Iptanus File Upload
≤4.12.2Update to 4.13.0
- Medium6.4Stored Cross-Site Scripting
Fruitful
<3.8.2Update to 3.8.2
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
WPvivid — Backup, Migration & Staging
≤0.9.35Update to 0.9.36
- Medium6.3Authenticated Settings Modification, Configuration Disclosure, and User Data Export
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.63Update to 3.64.1
- High8.3Blind Server-Side Request Forgery via tree.php
Canto
<2.0.1Update to 2.0.1
- High8.3Blind Server-Side Request Forgery via get.php
Canto
≤1.9.0Update to 2.0.1
- High8.3Unauthenticated Stored Cross-Site Scripting
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.63Update to 3.64.1
- Medium6.5API Token Exposure
Font Awesome
≤4.0.0-rc15Update to 4.0.0-rc17
- Medium4.3Missing Authorization to CSV Import
Product Import Export for WooCommerce – CSV Product Importer & Exporter
<1.7.5Update to 1.7.5
- High8.8Arbitrary User Creation
Export and Import Users and Customers
<1.3.9Update to 1.3.9
- Critical9.8Authentication Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
<2.1.6Update to 2.1.6
- Critical9.8Remote Code Execution
Search Meter
<2.13.3Update to 2.13.3
- Critical9.8Missing Authorization
ThemeREX Addons
≤1.70.3Update to 1.6.49.10 or 1.6.49.6 or 1.6.49.6.3 or 1.6.49.7 or 1.6.50.2 or 1.6.51.4 or 1.6.52.3 or 1.6.53.4 or 1.6.54.1 or 1.6.55.8 or 1.6.56.1 or 1.6.57.4 or 1.6.58.3 or 1.6.59.1.2 or 1.6.59.4 or 1.6.60.1 or 1.6.61.1.1 or 1.6.61.2.1 or 1.6.62.4 or 1.6.65.1 or 1.6.66.1 or 1.6.67.1 or 1.70.3.1
- High8.8Cross-Site Request Forgery Bypass
WPML Multilingual CMS
<4.3.7Update to 4.3.7
- High7.3Missing Authorization
WP Activity Log
<4.0.2Update to 4.0.2
- Critical9.1Unauthenticated Database Wiping
Custom Searchable Data Entry System
≤1.7.1No patch available
- Critical9.9Authenticated Privilege Escalation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- High8.0Cross-Site Request Forgery to Settings Modification
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- Critical9.8Remote Code Execution
WordPress WP-Advanced-Search
<3.3.4Update to 3.3.4
- Medium4.3Authenticated Email Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.3Update to 4.6.0.4
- Medium4.3Authenticated Settings and User Data Export
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- High8.6Unauthenticated Database Export
WordPress WP-Advanced-Search
≤3.3.3Update to 3.3.4
- Medium6.5Page Builder < 1.0.114 - Missing Authorization to Settings Update
Brizy – Page Builder
<1.0.114Update to 1.0.114
- Critical9.9Authenticated Settings Import to Privilege Escalation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.3Update to 4.6.0.4
- Medium5.3Unauthenticated Coupon Creation
WooCommerce Smart Coupons
<4.6.5Update to 4.6.5
- Medium4.8Stored Cross-Site Scripting
Appointment Booking Calendar
<1.3.35Update to 1.3.35
- High7.8CSV Injection
Appointment Booking Calendar
<1.3.35Update to 1.3.35
- Critical9.1Unprotected AJAX Actions
Responsive Starter Templates – Elementor Templates & Starter Sites
<2.2.6Update to 2.2.7
- High8.8Missing Authorization on AJAX Actions
Booked - Appointment Booking for WordPress
<2.2.6Update to 2.2.6
- High7.5VulnCrest analysisKEVPoCDirectory Traversal
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<1.3.28Update to 1.3.28