Database
WordPress Vulnerability Database (page 220)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Contributor+) Local File Inclusion
Golo Framework
≤1.7.3No patch available
- High7.5Authenticated (Contributor+) Local File Inclusion
SportsPress Pro
≤2.7.29No patch available
- Medium5.4Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter
CURCY – Multi Currency for WooCommerce
≤2.2.14Update to 2.2.15
- High7.5Authenticated (Contributor+) Local File Inclusion
Leedo – Modern, Colorful & Creative Portfolio WordPress Theme
≤3.0.0No patch available
- Medium4.3Cross-Site Request Forgery
Permalink Manager for WooCommerce
≤1.0.8.3Update to 1.0.8.4
- Medium5.32-Factor Authentication Bypass
security-ninja-premium
≤5.289Update to 5.290
- High7.5Authenticated (Contributor+) Local File Inclusion
Shopify
≤1.0.0No patch available
- High7.5Authenticated (Contributor+) Local File Inclusion
Flow
≤1.8No patch available
- Medium5.3Missing Authorization
Praison AI SEO
≤5.0.6Update to 5.0.7
- Medium4.3Cross-Site Request Forgery
seowp
≤3.12.2No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
cws-svgicons
≤1.5.5No patch available
- Medium5.3Missing Authorization
Universal Clocks
≤1.2.0No patch available
- High7.5Creative Agency WordPress Theme <= 2.5.1 - Authenticated (Contributor+) Local File Inclusion
Struktur - Creative Agency WordPress Theme
≤2.5.1No patch available
- High7.5Authenticated (Contributor+) Local File Inclusion
Aalto - Architecture and Interior Design WordPress Theme
≤1.8No patch available
- Medium4.3Professional LMS Education Center WordPress Theme <= 4.5.1 - Missing Authorization
EduMall - Professional LMS Education Center WordPress Theme
≤4.5.1Update to 4.5.2
- Medium6.5Authenticated (Contributor+) SQL Injection
WP Inventory Manager
≤2.5.3Update to 2.5.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute
GenerateBlocks
≤2.2.1Update to 2.3.0
- Medium5.3Unauthenticated Information Exposure
Kit (formerly ConvertKit) for WooCommerce
≤2.1.5Update to 2.1.7
- Medium4.3Appointment Booking for WordPress <= 3.0.0 - Missing Authorization
Booked - Appointment Booking for WordPress
≤3.0.0No patch available
- High7.5Authenticated (Contributor+) Local File Inclusion
Tonda - Elegant Shop WordPress Theme
≤2.5No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Lasso Lite – Affiliate Link Manager, URL Shortener & Link Tracking
≤152Update to 153
- Medium4.9Authenticated (Shop manager+) SQL Injection
Advanced Shipment Tracking for WooCommerce
≤4.0Update to 4.0.1
- Medium4.3Appointment Booking for WordPress <= 3.0.0 - Cross-Site Request Forgery
Booked - Appointment Booking for WordPress
≤3.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
WP Compress – Instant Performance & Speed Optimization
≤7.10.3Update to 7.10.04
- High7.5Travel Agency WordPress Theme <= 2.1 - Authenticated (Contributor+) Local File Inclusion
SetSail - Travel Agency WordPress Theme
≤2.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Structured Content (JSON-LD) #wpsc
≤1.7.0No patch available
- Medium4.3Cross-Site Request Forgery
pCloud WP Backup
≤2.0.7Update to 2.0.8
- High7.5Modern Architecture and Interior Design Theme <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion
Dør - Modern Architecture and Interior Design Theme
≤2.4.1No patch available
- High7.5Authenticated (Contributor+) Local File Inclusion
Kitchor - Interior Design WordPress Theme
≤1.4.3No patch available
- Medium5.3Missing Authorization
VW Wedding
≤1.3.7No patch available