Database
WordPress Vulnerability Database (page 281)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Author+) Arbitrary File Download
Download Monitor
≤5.1.9Update to 5.1.10
- High7.5Authenticated (Contributor+) PHP Object Injection
Anti-Malware Security and Brute-Force Firewall
≤4.23.87Update to 4.23.88
- Medium6.6Authenticated (Editor+) PHP Object Injection
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
≤3.106.0Update to 3.107.0
- High8.1Unauthenticated PHP Object Injection
Zoya - Minimal Blog Elementor Template Kit
≤1.4Update to 1.5
- Critical9.8Authenticated (Subscriber+) Arbitrary File Upload
Restaurant Zone
≤0.7.8Update to 0.7.9
- Medium6.6Authenticated (Shop manager+) PHP Object Injection
Advanced Product Fields (Product Addons) for WooCommerce
≤1.6.19Update to 1.6.20
- High8.1Unauthenticated PHP Object Injection
Manufaktur Solutions - Industry and Factory WordPress Theme
≤1.1.1Update to 1.2
- Medium5.3Missing Authorization
Tutor LMS – eLearning and online course solution
≤3.9.7Update to 3.9.8
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Kids Gift Shop
≤0.5.4Update to 0.5.5
- High8.1Unauthenticated PHP Object Injection
Esmée - Fashion Store WordPress Theme
≤1.4Update to 1.5
- High8.1Unauthenticated PHP Object Injection
EasyMeals - Food Blog WordPress Theme
≤1.5.1Update to 1.6
- High8.1Unauthenticated Local File Inclusion
Atomlab - Startup Landing Page WordPress Theme
≤2.4.5Update to 2.4.6
- Medium4.3Missing Authorization
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1132Update to 4.1133
- Medium6.1Reflected Cross-Site Scripting
Website LLMs.txt
≤8.2.6Update to 8.2.7
- Medium5.3Missing Authorization
Jupiter X Core
≤4.14.1Update to 4.14.2
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Ecommerce Zone
≤0.9.7Update to 0.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via calendly Shortcode
EMC – Embed Calendly Scheduling With Ease
≤4.4Update to 4.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'
Contextual Related Posts
≤4.2.1Update to 4.2.2
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode
Content Blocks (Custom Post Widget)
≤3.3.9Update to 3.4.1
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode
Categories Images
≤3.3.1Update to 3.3.2
- High8.8Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.16Update to 4.1.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via External iCal Feed Data
Page Builder Gutenberg Blocks – CoBlocks
≤3.1.16Update to 3.1.17
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributes
Flipbox Addon for Elementor
≤2.0.8Update to 2.1.2
- Medium6.1Reflected Cross-Site Scripting via 'shortcode_id' Parameter
Hostel
≤1.1.6Update to 1.1.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.3.6Update to 1.3.7
- High7.5Unauthenticated Sensitive Information Exposure via REST API
Easy Appointments
≤3.12.21Update to 3.12.22
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Pz-LinkCard
≤2.5.8.1No patch available
- High8.1Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.9.7Update to 1.3.9.8
- High7.5Unauthenticated Limited Arbitrary File Read via mfile Field
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.9.6Update to 1.3.9.7
- High8.8Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
WP Customer Area
≤8.3.4Update to 8.3.5