Database
WordPress Vulnerability Database (page 158)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Project Manager Pro
≤4.0.1No patch available
- Medium5.3Unauthenticated Information Exposure
TrueBooker – Appointment Booking and Scheduler System
<1.2.7Update to 1.2.7
- Medium5.3Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
<1.2.7Update to 1.2.7
- Critical9.8Unauthenticated Remote Code Execution
Broken Link Checker
<2.4.12Update to 2.4.12
- Critical9.8Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure
Wawp Country Code & Chat Widget for WooCommerce
≤4.8.6Update to 4.8.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
WPForms Pro
≤2.0.0.2Update to 2.0.0.3
- Medium5.3Unauthenticated Information Exposure
WP Cafe Pro
<3.0.15Update to 3.0.15
- High8.1Unauthenticated Local File Inclusion
Mane
≤1.7No patch available
- High7.2Authenticated (Administrator+) Remote Code Execution
All-in-One WP Migration and Backup
<7.108Update to 7.108
- Medium5.3Missing Authorization
EPROLO-Dropshipping
≤2.4.2No patch available
- High7.2Versatile MultiVendor WordPress Theme <= 2.0 - Unauthenticated Stored Cross-Site Scripting
Flatastic - Versatile MultiVendor WordPress Theme
≤2.0No patch available
- Medium5.3Missing Authorization
Extra Product Options Builder for WooCommerce
<1.2.176Update to 1.2.176
- High7.2Unauthenticated Stored Cross-Site Scripting
NotificationX Pro
≤3.1.4No patch available
- High7.3Unauthenticated Privilege Escalation
Abandoned Cart Pro for WooCommerce
≤10.4.0No patch available
- Medium4.3Missing Authorization
Homlisti
≤3.1.2No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Warehouse Cargo
≤2.7.0No patch available
- High8.1Unauthenticated Local File Inclusion
Tonda Core
<2.6Update to 2.6
- High7.5Unauthenticated SQL Injection
BookingPress Appointment Booking Pro
≤6.0.6Update to 6.1
- High7.2Home & Lifestyle Elementor WooCommerce Theme <= 1.3.19 - Unauthenticated Stored Cross-Site Scripting
Aora - Home & Lifestyle Elementor WooCommerce Theme
≤1.3.19Update to 1.3.20
- Medium6.5Authenticated (Subscriber+) SQL Injection
eShipper Commerce
≤2.16.13No patch available
- High7.5Unauthenticated SQL Injection
Capella | Restaurant WordPress
≤2.5.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
12 Step Meeting List
≤3.19.16Update to 3.19.17
- High7.5Unauthenticated SQL Injection
Directory Pro
≤2.5.8No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
IT Residence
≤3.2.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Events Made Easy
≤3.2.5Update to 3.2.6
- High8.1Unauthenticated PHP Object Injection
Flatastic - Versatile MultiVendor WordPress Theme
≤2.0No patch available
- High7.3Unauthenticated Privilege Escalation
Digits: WordPress Mobile Number Signup and Login
≤9.2No patch available
- High7.5Unauthenticated SQL Injection
Locatoraid Store Locator
≤3.9.72Update to 3.9.73
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Media Share Buttons & Social Sharing Icons
≤2.9.9Update to 3.0.0
- High7.3Unauthenticated Privilege Escalation
Simple JWT Login – Allows you to use JWT on REST endpoints.
<3.6.8Update to 3.6.8