Database
WordPress Vulnerability Database (page 255)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate
SMTP2GO for WordPress – Email Made Easy
≤1.16.0Update to 1.17.0
- High8.8Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute
Crawlomatic Multipage Scraper Post Generator
≤2.7.2Update to 2.7.3
- Medium4.3Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.6.7Update to 3.6.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
LiveSmart Video Chat Live Video Chat
≤1.2Update to 1.3
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function
Timetable and Event Schedule by MotoPress
≤2.4.16Update to 2.4.17
- High7.2Unauthenticated Stored Cross-Site Scripting via PHP_SELF
Login No Captcha reCAPTCHA
≤1.8.0Update to 1.8.1
- Medium6.5Unauthenticated Server-Side Request Forgery via Tracking Route
Independent Analytics – WordPress Analytics Plugin
≤2.14.9Update to 2.14.10
- High8.8Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter
ACF Frontend Admin by DynamiApps
≤3.29.2Update to 3.29.3
- Medium4.3Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter
FOX – Currency Switcher Professional for WooCommerce
≤1.4.6Update to 1.4.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Email Sending
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.4.7Update to 3.4.8
- Medium4.3Missing Authorization
SVG Support
≤2.5.14Update to 2.5.15
- Medium5.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.5Update to 5.1.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Master Slider – Responsive Touch Slider
≤3.10.8Update to 3.10.9
- High8.8Unauthenticated Privilege Escalation via Form Configuration Injection
ACF Frontend Admin by DynamiApps
≤3.29.2Update to 3.29.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Smart Online Order for Clover
≤1.6.0Update to 1.6.1
- Medium6.5Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure
Meta Field Block – Display Custom Fields for ACF, Meta Box and More
≤1.5.1Update to 1.5.2
- High7.5Authenticated (Contributor+) Local File Inclusion
SeedProd Pro
<6.19.5Update to 6.19.5
- Medium4.3Missing Authorization
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.2Update to 7.9.3
- High8.1Unauthenticated Local File Inclusion
Etude - Design Agency & Branding Agency WordPress Theme
≤1.6No patch available
- Medium4.7Unauthenticated Open Redirect
Meta for WooCommerce
≤3.7.0Update to 3.7.1
- High8.1Unauthenticated Local File Inclusion
Spike - Volleyball Sports WordPress Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
Granola - SEO & Marketing Agency WordPress Theme
≤1.13No patch available
- High8.1Unauthenticated Local File Inclusion
Printo
≤1.11No patch available
- High8.1Unauthenticated Local File Inclusion
Truemag
≤4.3.14.2No patch available
- High8.1Unauthenticated Local File Inclusion
Skyward
≤1.10No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
WP Magnific Popup
≤1.0No patch available
- High8.1Unauthenticated Local File Inclusion
Line Agency | Interior Design & Architecture WordPress Theme
≤1.3.1No patch available
- Medium4.3Missing Authorization
Adminimize
≤1.11.11Update to 1.11.12
- Medium4.3Missing Authorization
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤3.9.6Update to 3.9.7
- High8.1Food & Wine Store WordPress Theme <= 3.17 - Unauthenticated Local File Inclusion
WineShop - Food & Wine Store WordPress Theme
≤3.17No patch available