Database
WordPress Vulnerability Database (page 280)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Website LLMs.txt
≤8.2.6Update to 8.2.7
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions
Responsive Blocks – Page Builder for Blocks & Patterns
2.0.9 – 2.2.1Update to 2.2.2
- Medium5.3Unauthenticated Open Email Relay via REST API 'email_to' Parameter
Responsive Blocks – Page Builder for Blocks & Patterns
≤2.2.0Update to 2.2.1
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'arttype' Parameter
Plugin: CMS für Motorrad Werkstätten
≤1.0.0No patch available
- Medium4.7Unauthenticated Stored Cross-Site Scripting via CSV/Excel Data Import
wpDataTables (Premium)
≤6.5.0.4Update to 6.5.0.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'Image Source' Field
Image Source Control Lite – Show Image Credits and Captions
≤3.9.1Update to 3.9.2
- High8.1Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.4.4Update to 3.4.5
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path
wpForo Forum
≤3.0.5Update to 3.0.6
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Webenvo
≤0.0.6Update to 0.0.7
- High7.2Authenticated (Editor+) Remote Code Execution
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
≤3.106.0Update to 3.107.0
- High7.5Authenticated (Author+) PHP Object Injection
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
≤6.4.3Update to 6.4.4
- High8.1Unauthenticated PHP Object Injection
behold
≤1.5Update to 1.6
- High8.1Unauthenticated PHP Object Injection
Valeska - Fashion eCommerce WordPress Theme
≤1.2.2Update to 1.3
- Critical9.8Authenticated (Subscriber+) Arbitrary File Upload
Charity Zone
≤1.1.1Update to 1.1.2
- High8.1Unauthenticated PHP Object Injection
Ashtanga - Yoga Studio WordPress Theme
≤1.2Update to 1.3
- Medium5.3Missing Authorization
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.6.5Update to 3.6.6
- Medium6.1Reflected Cross-Site Scripting
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤2.17.3Update to 3.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Notification for Telegram
≤3.5Update to 3.5.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP Sessions Time Monitoring Full Automatic
≤1.1.4Update to 1.1.5
- High8.1Unauthenticated PHP Object Injection
Léonie - Nail and Beauty Salon WordPress Theme
≤1.2.1Update to 1.3
- High8.1100% Elementor WordPress Theme <= 1.0.9 - Unauthenticated PHP Object Injection
Elementra - 100% Elementor WordPress Theme
≤1.0.9Update to 1.1.0
- High8.1Flower Shop and Florist WordPress Theme <= 1.4 - Unauthenticated PHP Object Injection
Roisin - Flower Shop and Florist WordPress Theme
≤1.4Update to 1.5
- High8.1Unauthenticated PHP Object Injection
TechLink - Technology and IT Solutions WordPress Theme
≤1.3Update to 1.4
- Medium6.6Authenticated (Shop manager+) PHP Object Injection
YayMail – WooCommerce Email Customizer
≤4.3.3Update to 4.3.4
- High7.5Unauthenticated SQL Injection
InPost Gallery
≤2.1.4.6Update to 2.1.5
- High8.1Unauthenticated PHP Object Injection
Château - Winery and Wine Shop WordPress Theme
≤1.2.1Update to 1.3
- Medium6.6Authenticated (Shop manager+) PHP Object Injection
PDF Invoices & Packing Slips for WooCommerce
<5.9.0Update to 5.9.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.3.0.0Update to 4.3.0.1
- High7.5Authenticated (Author+) PHP Object Injection
Modula Image Gallery – Photo Grid & Video Gallery
≤2.14.18Update to 2.14.19
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Kids Online Store
≤0.8.9Update to 0.9.0