Database
WordPress Vulnerability Database (page 256)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Contributor+) Information Disclosure
GenerateBlocks
≤2.1.0Update to 2.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Advanced Custom Fields: Font Awesome Field
≤5.0.2Update to 6.0.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Duplicate Page and Post
≤2.9.5Update to 2.9.6
- High8.1Unauthenticated Local File Inclusion
Choreo
≤1.6No patch available
- Critical9.1Unauthenticated Arbitrary File Deletion
VikBooking Hotel Booking Engine & PMS
≤1.8.10Update to 1.8.11
- High8.1Unauthenticated Local File Inclusion
Orpheus
≤1.3No patch available
- High8.1Unauthenticated Local File Inclusion
Gita
≤1.11No patch available
- High8.1Unauthenticated Local File Inclusion
Gamic - Gaming Metaverse Game & Crypto WordPress Theme
≤1.15No patch available
- High8.1Unauthenticated Local File Inclusion
Eventicity
≤1.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤5.0.7Update to 5.0.8
- Medium5.3Missing Authorization
Advanced Custom Fields (ACF®)
≤6.8.1Update to 6.8.2
- Medium4.3Missing Authorization
WP Meta and Date Remover
≤2.3.6Update to 2.3.7
- Medium4.3Missing Authorization
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
≤2.4.29Update to 2.4.30
- High8.1Unauthenticated Local File Inclusion
Grecko | Business WordPress Theme
≤5.17No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.14.16Update to 2.15.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint
3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On
≤2.0.1Update to 2.0.2
- High8.1Unauthenticated Local File Inclusion
ITactics - IT Solutions & Digital Startup WordPress Theme + AI
≤1.0No patch available
- Medium4.3Missing Authorization
Product Import Export for WooCommerce – CSV Product Importer & Exporter
≤2.5.6Update to 2.5.7
- High8.1Unauthenticated Local File Inclusion
tipsy
≤1.1No patch available
- High8.1Creative Multi-Purpose WordPress Theme <= 2.1.5 - Unauthenticated Local File Inclusion
Roneous - Creative Multi-Purpose WordPress Theme
≤2.1.5No patch available
- High8.1Unauthenticated Local File Inclusion
Resurs - Physiotherapy & Psychology Rehabilitation WordPress Theme
≤1.3No patch available
- Medium6.1Reflected Cross-Site Scripting
weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce
≤2.1.2Update to 2.1.3
- High8.1Unauthenticated Local File Inclusion
Eros
≤1.3No patch available
- High8.1Unauthenticated Local File Inclusion
snowy
≤1.13No patch available
- High8.1Unauthenticated Local File Inclusion
Gunslinger
≤1.7No patch available
- Medium5.3Missing Authorization
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤3.9.6Update to 3.9.7
- Medium6.5Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG
Xpro Elementor Addons - Pro
≤1.4.7Update to 1.4.8
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings
MinhNhut Link Gateway
≤3.6.1No patch available
- Medium6.1Reflected Cross-Site Scripting via 'url' Parameter
MinhNhut Link Gateway
≤3.6.1No patch available
- Medium4.8Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' Parameter
myLinksDump
≤1.6No patch available