Database
WordPress Vulnerability Database (page 226)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery via 'ga_id' Parameter
Plugin for Google Analytics by IO technologies
≤1.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter
Team Members – Multi Language Supported Team Plugin
≤8.7Update to 8.8
- Medium5.3Missing Authorization
NOWPayments for WooCommerce – Crypto Payment Gateway
≤1.4.0Update to 1.4.1
- Critical9.8Unauthenticated Remote Code Execution
Blocksy Companion Pro
≤2.1.46Update to 2.1.47
- High8.1Unauthenticated Local File Inclusion
Lighthouse | School for Kids with Disabilities & Special Needs WordPress Theme
≤1.2.12No patch available
- Medium6.5University and College WordPress Theme <= 2.2.2 - Authenticated (Subscriber+) SQL Injection
Unicamp - University and College WordPress Theme
≤2.2.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Automotive Listings
≤18.6No patch available
- Medium5.3Missing Authorization
Woffice CRM
≤5.4.32Update to 5.4.33
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Simple User Avatar
≤4.9Update to 5.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Internal Links Manager
≤3.0.3Update to 3.0.4
- Medium5.3Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.7Update to 4.3.8
- Medium4.3Missing Authorization
Quads Ads Manager for Google AdSense
≤3.0.3Update to 3.0.4
- Medium5.3Unauthenticated Order Payment Manipulation
PayPlus Payment Gateway
≤8.2.1Update to 8.2.2
- Medium4.3Creative Portfolio WordPress Theme <= 4.7.2 - Cross-Site Request Forgery
Werkstatt - Creative Portfolio WordPress Theme
≤4.7.2No patch available
- Medium6.1Reflected Cross-Site Scripting
PublishPress Tag Groups is the Advanced Way to Display Your Taxonomy Terms
≤2.1.0Update to 2.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.4.2Update to 5.4.3
- Medium6.1Reflected Cross-Site Scripting
Link Whisper Free
≤0.9.4Update to 0.9.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.27Update to 3.7.28
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
TheFox | Responsive Multi-Purpose WordPress Theme
≤3.9.70No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.22Update to 6.4.23
- High8.1Unauthenticated PHP Object Injection
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.21Update to 1.0.22
- Medium5.3Missing Authorization
Woostify Sites Library
≤1.6.2No patch available
- High7.5Unauthenticated SQL Injection
WP Fast Total Search – The Power of Indexed Search
≤1.80.280Update to 1.81.282
- Medium5.3Missing Authorization
POS Entegratör – Gurmehub Ödeme Eklentisi
≤3.7.103Update to 3.8.0
- Medium5.3Missing Authorization
Japanized for WooCommerce
≤2.9.12Update to 2.9.13
- High7.2Unauthenticated Stored Cross-Site Scripting
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages
≤1.5.3.5Update to 1.5.3.6
- Medium5.3Missing Authorization
PayPlus Payment Gateway
≤8.2.1Update to 8.2.2
- High8.8Church WordPress Theme <= 1.1.9 - Authenticated (Subscriber+) Arbitrary File Upload
Zegen - Church WordPress Theme
≤1.1.9No patch available
- Medium5.3Missing Authorization
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.23Update to 6.4.24
- Medium6.1Reflected Cross-Site Scripting
ARforms
≤7.1.2Update to 7.2