Database
WordPress Vulnerability Database (page 259)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute
Splide Carousel Block
≤1.7.1Update to 1.7.2
- Medium5.3Unauthenticated Denial of Service
Simply Schedule Appointments
≤1.6.11.5Update to 1.6.11.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title
Style Kits for Elementor
≤2.5.0Update to 2.6.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Geo Mashup
≤1.13.19Update to 1.13.20
- High8.1Unauthenticated Local File Inclusion
Rosaleen
≤2.8No patch available
- High8.1Unauthenticated Local File Inclusion
Ingenioso
≤1.14.0No patch available
- Medium6.1Reflected Cross-Site Scripting via 's' Parameter
Gutenverse – WordPress Blocks, Page Builder & Site Editor
≤3.4.6Update to 3.4.7
- High8.1Unauthenticated Local File Inclusion
Kelly Young
≤1.1.0No patch available
- High8.1Startup & Consulting Services WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion
Confidant - Startup & Consulting Services WordPress Theme
≤1.4No patch available
- High8.1Unauthenticated Local File Inclusion
CopyPress
≤1.4.5No patch available
- High8.1Unauthenticated Local File Inclusion
Nexio
≤1.10.0No patch available
- High8.1Unauthenticated Local File Inclusion
Mission
≤1.22No patch available
- Medium4.3Authenticated (Subscriber+) Arbitrary File Deletion
JobCareer
≤7.3No patch available
- High8.1Unauthenticated PHP Object Injection
SeaFood Company - Fish Restaurant WordPress Theme
≤1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Felan Framework
≤1.1.3No patch available
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Nyla - A Fresh & Modern WooCommerce Theme
≤1.7No patch available
- Medium4.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.1.5Update to 2.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints
LiteSpeed Cache
≤7.7Update to 7.8
- Medium4.3Missing Authorization
Feeds for TikTok – Keep Your Site Fresh with Your Latest Videos
≤1.0.24Update to 1.0.25
- Medium5.3Missing Authorization
E-cab Taxi Booking Manager for Woocommerce
≤2.0.1Update to 2.0.2
- High8.1Unauthenticated Local File Inclusion
Snow Club | Ski Resort and Snowboard Classes WordPress Theme
≤1.1No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Modula Image Gallery – Photo Grid & Video Gallery
≤2.14.23Update to 2.14.24
- High8.1Unauthenticated PHP Object Injection
Plumbing - Plumber and Handyman WordPress Theme
≤1.6No patch available
- High8.1Unauthenticated Local File Inclusion
Abelle
≤1.22No patch available
- High8.1Unauthenticated Local File Inclusion
Quirky - NFT, Token & Artist Marketplace WordPress Theme
≤1.23No patch available
- High8.1Unauthenticated PHP Object Injection
Reisen | Auto Store & Car Repair WordPress Theme
≤1.4.1No patch available
- High8.1Unauthenticated Local File Inclusion
Corbesier
≤1.15.0No patch available
- High8.1Unauthenticated Local File Inclusion
Putter
≤1.17No patch available
- High8.1Unauthenticated Local File Inclusion
Top Dog
≤1.0.5No patch available
- High8.1Unauthenticated Local File Inclusion
Deliciosa
≤1.10.0No patch available