Database
WordPress Vulnerability Database (page 218)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Local File Inclusion
RT-Theme 18 Responsive WordPress Theme
≤2.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
tagDiv Opt-In Builder
≤1.7.5Update to 1.7.6
- High8.1Unauthenticated PHP Object Injection
RT-Theme 18 Responsive WordPress Theme
≤2.5No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
微信二维码登陆
≤1.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Advanced Ads – Ad Manager & AdSense
≤2.0.22Update to 2.0.23
- Medium5.3Missing Authorization
Flatsome
≤3.20.5No patch available
- High7.5Unauthenticated Arbitrary File Read
Printcart Store – Web to Print Product Designer for WooCommerce
≤2.5.2Update to 2.5.3
- Critical9.8Malicious Plugin
Premium SEO
all versionsNo patch available
- Critical9.8Unauthenticated Privilege Escalation
MemberGlut – Membership, Roles & Content Restriction
≤1.1.4Update to 1.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Simply Schedule Appointments
≤1.6.12.3Update to 1.6.12.4
- Critical9.8Unauthenticated Remote Code Execution
FacturaONE para WooCommerce con VeriFactu
≤5.36Update to 5.37
- Medium4.3Missing Authorization
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤10.11.1Update to 11.0.0
- Medium6.1Reflected Cross-Site Scripting
Sina Extension for Elementor
≤3.10.1Update to 3.10.2
- Medium6.1Reflected Cross-Site Scripting
RT-Theme 18 Responsive WordPress Theme
≤2.5No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.5.1Update to 8.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.3.7Update to 8.3.8
- Medium4.3Cross-Site Request Forgery
CrawlWP SEO – Complete WordPress SEO Plugin with AI, Indexing & Search Performance
≤3.0.16Update to 3.0.17
- Medium5.3Unauthenticated Information Exposure
FormLayer
≤1.0.6Update to 1.0.7
- Medium5.3Unauthenticated Information Exposure
Exclusive Addons for Elementor
≤2.7.9.9Update to 2.8.0
- Medium4.3Missing Authorization
ProfileGrid – User Profiles, Groups and Communities
≤5.9.9.6Update to 5.9.9.7
- Critical9.8Unauthenticated Privilege Escalation via Password Reset
CAFEHAUS API
≤1.0.0No patch available
- Medium4.3Missing Authorization
ProfileGrid – User Profiles, Groups and Communities
≤5.9.9.6Update to 5.9.9.7
- Medium5.3Unauthenticated Payment Bypass
ProfileGrid – User Profiles, Groups and Communities
≤5.9.9.6Update to 5.9.9.7
- Medium5.3Missing Authorization to Unauthenticated Opt-In Deactivation
WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation
≤1.4.37Update to 1.4.38
- High7.5Unauthenticated SQL Injection
Project Management, Bug and Issue Tracking Plugin – Software Issue Manager
≤5.0.0Update to 5.1.0
- Critical9.8Unauthenticated Privilege Escalation
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.16.17Update to 4.16.18
- Medium4.3Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.0.7Update to 2.0.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.1Update to 5.6.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API
Zakra
≤4.2.0Update to 4.2.1
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.16Update to 2.8.17