Database
WordPress Vulnerability Database (page 159)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Manual Image Crop
<1.15Update to 1.15
- High8.1Unauthenticated Local File Inclusion
WP Cafe Pro
≤3.0.14Update to 3.0.15
- High8.1Unauthenticated Local File Inclusion
Verdure Core
≤1.2No patch available
- High7.3Unauthenticated Privilege Escalation
Capella | Restaurant WordPress
≤2.5.5No patch available
- Medium4.3Missing Authorization
ECS – Ele Custom Skin for Elementor
<4.3.10Update to 4.3.10
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP BASE Booking of Appointments, Services and Events
≤6.3.2Update to 6.4.0
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Directory Kit
<1.5.7Update to 1.5.7
- Medium4.3Authenticated (Subscriber+) Payment Bypass
Premium Packages – Sell Digital Products Securely
<7.0.7Update to 7.0.7
- Critical9.8Authentication Bypass to Account Takeover
WP Social Media Login
≤1.0.6No patch available
- High8.1Unauthenticated Local File Inclusion
Mane
≤1.7No patch available
- Medium5.3Missing Authorization
New User Approve
≤3.2.8Update to 3.2.9
- High7.5Authenticated (Author+) Local File Inclusion
WP Cafe Pro
≤3.0.14Update to 3.0.15
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
<2.3.3Update to 2.3.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Smart Cleaning
≤4.8.6No patch available
- Medium5.3Missing Authorization
Conekta Payment Gateway
≤6.2.1Update to 6.2.2
- Medium4.3Cross-Site Request Forgery
Easy Elementor Addons – Addons Pack for Elementor Page Builder
≤2.3.7Update to 2.3.8
- High8.1Unauthenticated PHP Object Injection
FreightCo – Free Transportation & Logistics WordPress Theme
≤1.1.15No patch available
- Medium5.3Missing Authorization
CatFolders Document Gallery & PDF Library
<2.0.7Update to 2.0.7
- Critical9.8Authentication Bypass to Administrator
Social Login & Sharing buttons with Analytics By SoClever
≤1.2.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget
≤1.8.0Update to 1.8.1
- Medium5.3Missing Authorization
Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More
≤1.7.1Update to 1.8.0
- High7.2Unauthenticated Stored Cross-Site Scripting
WPComplete
≤2.9.5.6Update to 2.9.5.7
- High8.1Elegant Shop WordPress Theme < 2.6 - Unauthenticated Local File Inclusion
Tonda - Elegant Shop WordPress Theme
<2.6Update to 2.6
- Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
Tutor LMS – eLearning and online course solution
≤4.0.5Update to 4.0.6
- Critical9.8Unauthenticated Privilege Escalation
Jawn
≤1.4.2No patch available
- High7.2All-in-one WooCommerce WordPress Theme <= 2.6.2 - Unauthenticated Stored Cross-Site Scripting
Urna - All-in-one WooCommerce WordPress Theme
≤2.6.2Update to 2.6.3
- Medium5.3Unauthenticated Mail Relay
Estatik Real Estate Plugin
<4.3.4Update to 4.3.4
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Firebase Authentication
<1.7.1Update to 1.7.1
- High7.5Unauthenticated Path Traversal
WPvivid — Backup, Migration & Staging
<0.9.131Update to 0.9.131
- Medium4.9Authenticated (Administrator+) SQL Injection
InfiniteWP Client
≤1.13.9Update to 1.13.10