Database
WordPress Vulnerability Database (page 230)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Contributor+) Local File Inclusion
Panorama – Turn Photos into Immersive Virtual Tours
≤1.6.1Update to 1.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Carousel
≤1.0.0.41No patch available
- Medium5.3Missing Authorization
Donation Thermometer
≤2.2.7Update to 2.2.8
- Medium6.5Authenticated (Contributor+) SQL Injection
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.5.2Update to 2.5.3
- Medium4.3Cross-Site Request Forgery
Child Theme Wizard
≤1.4Update to 1.5
- Medium4.3Cross-Site Request Forgery
Real Estate 7 WordPress
≤3.5.9Update to 3.6.0
- Medium4.3Missing Authorization
Affiliates Manager
≤2.9.49Update to 2.9.50
- Medium5.3Missing Authorization
Admin and Site Enhancements (ASE)
≤8.8.3Update to 8.8.4
- Medium6.5Authenticated (Contributor+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤3.9.1Update to 3.10.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Exclusive Addons for Elementor
≤2.7.9.8Update to 2.7.9.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
BNE Testimonials
≤2.0.8Update to 2.0.8.1
- Medium4.3Missing Authorization
Newsletters
≤4.13Update to 4.14
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Order Cancellation
WPS Bookings for WooCommerce
≤3.11.6Update to 3.11.7
- Medium4.3Cross-Site Request Forgery
Gmail SMTP
≤1.2.3.19Update to 1.2.3.20
- Medium6.1Reflected Cross-Site Scripting
weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce
≤2.1.2Update to 2.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
NanoMag - Responsive WordPress Magazine Theme
≤1.8Update to 1.9
- High7.5Authenticated (Contributor+) Local File Inclusion
Goya Core
<1.0.9.4Update to 1.0.9.4
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Interactive Content – H5P
≤1.17.7Update to 1.17.8
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Hester Core
≤1.1.8Update to 1.1.9
- Medium5.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.7.1Update to 2.7.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.1.0Update to 2.1.1
- Medium4.3Cross-Site Request Forgery
FunnelKit Payment Gateway for Stripe WooCommerce
≤1.14.0.3Update to 1.14.0.4
- Medium4.3Missing Authorization
WPComplete
≤2.9.5.5Update to 2.9.5.6
- Medium5.3Missing Authorization
HTML5 Video Player – embed fast, responsive videos with ease
≤2.11.0Update to 2.11.1
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Payment Token Modification
Frisbii Pay
≤1.8.9Update to 1.8.10
- Medium5.3Appointment Booking WordPress Plugin <= 1.1.0 - Unauthenticated Insecure Direct Object Reference
BookPro - Appointment Booking WordPress Plugin
≤1.1.0No patch available
- High7.5Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 - Authenticated (Contributor+) Local File Inclusion
splash
≤4.4.3Update to 4.4.4
- Medium4.3Missing Authorization
Nelio Content – Editorial Calendar & Social Media Auto-Posting
≤4.3.4Update to 4.3.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
PPWP – Password Protect Pages
≤1.9.19Update to 1.9.20
- Medium4.3Add Member From Admin <= 0.7.2 - Cross-Site Request Forgery
Paid Memberships Pro - Add Member From Admin
≤0.7.2Update to 0.7.3