Database
WordPress Vulnerability Database (page 227)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Customer+) Path Traversal
Tax Exempt for WooCommerce
≤1.9.3No patch available
- Medium6.1Reflected Cross-Site Scripting
TheFox | Responsive Multi-Purpose WordPress Theme
≤3.9.76No patch available
- Medium4.3Official SMTP Integration <= 1.0.7 - Cross-Site Request Forgery
MailerSend – Official SMTP Integration
≤1.0.7Update to 1.0.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Content Deletion
OpenAI Chatbot for WordPress – Helper
≤1.1.4No patch available
- High7.5Tour Booking, Travel, Hotel <= 5.4.5 - Authenticated (Subscriber+) Local File Inclusion
Tour Master - Tour Booking, Travel, Hotel
≤5.4.5No patch available
- Medium4.3WooCommerce Marketplace WordPress <= 3.2.8 - Missing Authorization
Martfury - Marketplace Mobile App Figma Template
≤3.2.8No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WooCommerce Designer Pro
≤1.9.34Update to 1.9.35
- Medium4.3Missing Authorization
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
≤2.7.6Update to 2.7.7
- Medium5.3Unauthenticated Insecure Direct Object Reference
Colissimo shipping methods for WooCommerce
≤2.9.0Update to 2.10.0
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤11.7.0Update to 11.7.1
- Medium6.1Reflected Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.0Update to 4.4.1
- High7.2Unauthenticated Stored Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.4.0Update to 5.5.0
- Medium5.3Missing Authorization
All-in-One WP Migration and Backup
≤7.105Update to 7.106
- High8.1Authenticated (Performer+) Arbitrary File Deletion
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.4.8Update to 7.4.9
- Medium4.3Missing Authorization
MainWP Dashboard: Self-hosted WordPress Management for Agencies
≤6.1.1Update to 6.1.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Reviews Feed – Google Reviews, Yelp, Trustpilot & Tripadvisor Reviews Widget
≤2.6.4Update to 2.6.5
- Medium4.3Creative Portfolio WordPress Theme <= 4.7.2 - Missing Authorization
Werkstatt - Creative Portfolio WordPress Theme
≤4.7.2No patch available
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
Elementor Website Builder – more than just a page builder
≤4.1.3Update to 4.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Admin and Site Enhancements (ASE) Pro
≤8.8.5Update to 8.8.6
- High8.1Unauthenticated Arbitrary Code Execution
W3 Total Cache
≤2.9.4Update to 2.10.0
- High8.1Corporate Business <= 3.4.10 - Unauthenticated Local File Inclusion
pearl
≤3.4.10No patch available
- High7.5Unauthenticated SQL Injection
Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce
≤1.2.5Update to 1.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.10Update to 2.0.11
- High8.1Unauthenticated Local File Inclusion
Audrey - Fashion WordPress Theme
≤1.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.8Update to 1.1.9
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Embed Privacy
≤1.12.3Update to 1.12.4
- Medium5.3Missing Authorization
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<4.9.9Update to 4.9.9
- High8.1Unauthenticated PHP Object Injection
Novalnet Payment Gateway for WooCommerce
≤12.10.3Update to 12.10.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Jobify - Job Board WordPress Theme
≤4.3.2Update to 4.3.3
- High7.2Unauthenticated Server-Side Request Forgery
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.11Update to 6.0.12