Database
WordPress Vulnerability Database (page 178)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Export Import Menus
≤1.9.2No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Lenxel WP
≤1.0.31No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Podcast Player – Your Podcasting Companion
≤8.3.0Update to 8.3.1
- Medium5.3Missing Authorization
MotoPress Hotel Booking
≤6.2.2Update to 6.2.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Account Block Bypass
Belaka – Block User Account
≤2.0.0Update to 2.0.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.6Update to 2.5.7
- High8.1Unauthenticated PHP Object Injection
Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor
≤1.5.3No patch available
- Medium5.3Missing Authorization to Unauthenticated AI API Key Abuse
AI ChatBot for WooCommerce – WoowBot
<4.8.4Update to 4.8.4
- Medium6.5Startup & Technology WordPress Theme <= 1.3.10 - Authenticated (Subscriber+) Arbitrary File Dowload
AI Hub - Startup & Technology WordPress Theme
≤1.3.10No patch available
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
<10.31.3Update to 10.31.3
- Critical9.8Unauthenticated Arbitrary File Upload
Webinfos
≤1.2No patch available
- High8.1Unauthenticated PHP Object Injection
69 Clothing | Brand Store & Fashion Boutique WordPress Theme
≤1.2.11.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
≤1.9.2Update to 1.10.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation
Accelerate
≤1.5.3Update to 1.5.4
- Medium5.3Missing Authorization to Block Visibility Bypass via ai_ajax
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.16Update to 2.8.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.3.2Update to 5.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block
Post Grid Gutenberg Blocks – PostX
≤5.0.13Update to 5.0.14
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
TranslatePress – Translate Multilingual sites with AI Translation
≤3.2.6Update to 3.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
≤3.111.0Update to 3.111.1
- High8.1Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
WPMU DEV Dashboard
≤5.0.0Update to 5.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP
≤2.2.95Update to 2.3.0
- High8.86.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter
File Manager
6.0 – 6.9Update to 6.9.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.56.1Update to 1.56.2
- Medium4.7Authenticated (Editor+) Privilege Escalation
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
≤2.45.0Update to 2.50.0
- Medium4.7Authenticated (Editor+) Privilege Escalation
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
≤2.45.0Update to 2.50.0
- High7.5Unauthenticated SQL Injection
Iptanus File Upload
≤5.1.7Update to 5.1.8
- High7.3Unauthenticated Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.12.1Update to 2.12.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Mercado Pago payments for WooCommerce
≤8.9.0Update to 8.9.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
Library Management System
≤3.6.6Update to 3.6.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Download Manager
<3.3.66Update to 3.3.66