Database
WordPress Vulnerability Database (page 225)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Receipt Disclosure
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.3.8Update to 5.3.9
- Medium6.1Reflected Cross-Site Scripting
Automotive Car Dealership Business WordPress Theme
≤13.3.3No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.11Update to 6.0.12
- Medium4.3Missing Authorization
Advanced Contact form 7 DB
≤2.0.9Update to 2.1.0
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.7Update to 3.7.8
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.161Update to 2.8.162
- High7.2Unauthenticated Stored Cross-Site Scripting
Perfmatters
≤2.6.4Update to 2.6.5
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Note/Progress Modification
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.8.0Update to 3.8.1
- High7.2Authenticated (Editor+) Arbitrary Code Execution
Five Star Business Profile and Schema
≤2.3.19Update to 2.3.20
- Medium5.3Missing Authorization
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
≤3.0.0Update to 3.1.0
- High7.5Authenticated (Contributor+) PHP Object Injection
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤7.5Update to 7.6
- Medium6.1Reflected Cross-Site Scripting
LMS - Education WordPress Theme
≤9.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WowAddons – Product Addons and Product Options With Custom Fields
≤1.6.14Update to 1.6.15
- High7.2Unauthenticated Stored Cross-Site Scripting
Simple Link Directory Pro
≤15.0.5Update to 15.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Slider Revolution
7.0.0 – 7.0.16Update to 7.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Fitness Zone WordPress Theme
≤5.7No patch available
- High7.5Creative Portfolio WordPress Theme <= 4.8.3 - Authenticated (Contributor+) PHP Object Injection
Werkstatt - Creative Portfolio WordPress Theme
≤4.8.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Photo Album Plus
≤9.2.02.004Update to 9.2.03.001
- High7.2Unauthenticated Stored Cross-Site Scripting
Kids Life | Children School WordPress
≤5.2No patch available
- High7.5Unauthenticated Arbitrary File Read
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
≤3.0.0Update to 3.1.0
- Medium5.3Car Dealer, Rental & Listing WordPress theme <= 5.6.80 - Missing Authorization
Motors - Car Dealer, Rental & Listing WordPress theme
≤5.6.80No patch available
- Medium4.3Missing Authorization
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.1.0Update to 8.2.0
- Medium6.1Reflected Cross-Site Scripting
NativeChurch
≤4.8.8.2No patch available
- High7.2Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' Field
Ajax Load More - Filters
≤3.4.1Update to 3.4.2
- Critical9.8WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter
EventON (Pro) - WordPress Virtual Event Calendar Plugin
≤5.0.11No patch available
- High8.0Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field
Export User Data
≤2.2.6No patch available
- Critical9.8User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite
ProfileGrid – User Profiles, Groups and Communities
≤5.9.9.5Update to 5.9.9.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field
Editorial Rating – Product Review & Rating System
≤4.0.5Update to 4.0.6
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions
Premium Addons for KingComposer
≤1.1.1No patch available
- Medium6.5Authenticated (Author+) Path Traversal in 'layers[].id' Parameter
PixMagix – WordPress Image Editor
≤1.7.2Update to 1.7.3