Database
WordPress Vulnerability Database (page 261)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Brikk - Directory & Listing WordPress Theme
≤3.0.0No patch available
- High7.5Unauthenticated SQL Injection
Realtyna Organic IDX plugin + WPL Real Estate
≤5.1.0Update to 5.2.0
- Medium5.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.3.3Update to 5.3.4
- High8.1Renewable Energy & Ecology WordPress Theme <= 1.15 - Unauthenticated Local File Inclusion
Geya - Renewable Energy & Ecology WordPress Theme
≤1.15No patch available
- High8.1Unauthenticated Local File Inclusion
Medeus
≤1.14No patch available
- Medium5.3Missing Authorization
Mayosis Core
≤5.4.7No patch available
- High8.1Unauthenticated Local File Inclusion
Fermentio — Brewery and Winemaking Restaurant WordPress Theme
≤1.5.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Sweet Date Core
<1.1.5Update to 1.1.5
- High8.8Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing <= 1.6.6 - Authenticated (Subscriber+) Privilege Escalation
Genemy - Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing
≤1.6.6No patch available
- High8.1Cricket Team Sports WordPress Theme + AI <= 1.8 - Unauthenticated Local File Inclusion
Spin - Cricket Team Sports WordPress Theme + AI
≤1.8No patch available
- High8.1Unauthenticated Local File Inclusion
raiderspirit
≤1.1.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Animation Addons – Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates
≤2.6.3Update to 2.6.4
- High8.1Unauthenticated PHP Object Injection
Hot Coffee | Coffee Shop & Cafe WordPress Theme
≤1.7No patch available
- Medium4.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.6.7Update to 3.6.8
- Medium5.3Missing Authorization
KiviCare – Clinic & Patient Management System (EHR)
≤4.3.0Update to 4.4.0
- Medium4.3Cross-Site Request Forgery
Subscriptions for WooCommerce with Stripe Recurring Payments
≤1.9.1Update to 1.9.2
- Medium4.3Cross-Site Request Forgery
Export WordPress Pages to Static HTML & PDF — Static Site Export
≤6.0.0Update to 6.0.1
- Medium5.3Missing Authorization
Search Analytics for WP – Site Search Tracking
<1.5.0Update to 1.5.0
- Medium4.3Missing Authorization
Autoship Cloud for WooCommerce Subscription Products
≤2.14.3Update to 2.14.4
- Medium4.3Missing Authorization
Newses
≤2.0.0.77Update to 2.0.0.78
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Form Builder CP
≤1.2.46Update to 1.2.47
- Medium5.3Unauthenticated Information Exposure
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤10.0.9Update to 10.0.10
- High7.2Authenticated (Admin+) Remote Code Execution
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<7.1.3Update to 7.1.3
- Medium4.3Missing Authorization
Home Health Care, Medical Care WordPress Theme - NanoCare
<1.2.2Update to 1.2.2
- Medium4.3Missing Authorization
FlexTable – Data Table Sync with Google Sheets
≤3.24.0Update to 3.24.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Team Showcase
≤1.22.28No patch available
- Medium5.3Missing Authorization
RSVP and Event Management
≤2.7.16Update to 2.7.17
- High7.2Unauthenticated Stored Cross-Site Scripting
WPCS – WordPress Currency Switcher Professional
≤1.3.1Update to 1.3.2
- Medium5.3Missing Authorization
Auto Affiliate Links
≤6.8.8.3Update to 6.8.9
- Low2.7Missing Authorization
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
<5.2.10Update to 5.2.10