Database
WordPress Vulnerability Database (page 177)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.6.2Update to 4.6.3
- Medium6.6Authenticated (Editor+) Local File Inclusion
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.19Update to 4.1.20
- High8.1Unauthenticated PHP Object Injection
Adrena | Airsoft Club & Paintball WordPress Theme
≤1.2.14No patch available
- Medium4.3Missing Authorization to Authenticated (Author+) Cross-User Import Job Manipulation and Post Deletion
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.5Update to 5.2.6
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Booking Price Manipulation
Pinpoint Booking System – Legacy version
≤2.9.9.7.1Update to 2.9.9.7.2
- High7.5Unauthenticated SQL Injection
ProSolution WP Client
≤2.0.5Update to 2.0.6
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Customer Data Modification
MotoPress Hotel Booking
≤6.2.2Update to 6.2.3
- Medium5.3IP Spoofing to Vote Restriction Bypass
YOP Poll
7.0.0 – 7.0.5Update to 7.0.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
Simply Schedule Appointments
<1.6.12.6Update to 1.6.12.6
- High7.3Unauthenticated Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤3.9.7Update to 3.9.8
- Medium4.3Missing Authorization
Advanced Custom Fields: Font Awesome Field
≤6.1.2Update to 6.1.3
- Medium6.4Authenticated (Instructor+) Server-Side Request Forgery
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.3Update to 4.4.4
- High7.5Unauthenticated SQL Injection
Term Pages
≤1.0.0Update to 2.0.0
- Medium4.3AI Powered <= 15.0.8 - Cross-Site Request Forgery
Simple Link Directory Pro - AI Powered
≤15.0.8Update to 15.0.9
- High8.1Psychology, Therapy & Counseling Theme <= 1.18.0 - Unauthenticated PHP Object Injection
Advice - Psychology, Therapy & Counseling Theme
≤1.18.0No patch available
- Critical9.8OTP Brute Force
OTP Login With Phone Number, OTP Verification
≤1.8.70Update to 1.8.71
- Medium5.3Missing Authorization
GDPR Cookie Consent Plugin for WordPress
<3.5.3Update to 3.5.3
- High7.5Unauthenticated SQL Injection
ProSolution WP Client
≤2.0.8Update to 2.0.9
- Medium5.3Unauthenticated Booking Information Disclosure
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.30.33Update to 10.30.34
- Medium6.1Reflected Cross-Site Scripting
Agrion - Agriculture Farm & Farmers Template Kit
≤1.0.0No patch available
- High8.1Unauthenticated PHP Object Injection
Abelle
≤1.22No patch available
- Medium5.3Unauthenticated Information Exposure
Custom CSS and JavaScript
≤2.0.16No patch available
- Medium5.3CAPTCHA Bypass
CAPTCHA 4WP – Antispam CAPTCHA solution for WordPress
≤7.6.0Update to 7.6.1
- Critical9.8Unauthenticated Privilege Escalation
POUCO Import Users
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce
≤1.2.6Update to 1.2.7
- Medium4.3Cross-Site Request Forgery
Plugins Garbage Collector (Database Cleanup)
≤0.14Update to 0.15
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.30.33Update to 10.30.34
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
Subscribe to Comments
≤2.3.1No patch available
- High8.1Agriculture & Organic Farm Theme <= 1.21.0 - Unauthenticated PHP Object Injection
Agricola - Agriculture & Organic Farm Theme
≤1.21.0No patch available
- High8.1Authentication Bypass via Brute Force
Login & Register Customizer – Forms, Popup, Profile & WooCommerce
<3.2.5Update to 3.2.5