Database
WordPress Vulnerability Database (page 282)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Injected Backdoor
WowShipping Pro
<1.0.8Update to 1.0.8
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
WpStream – Live Streaming, Video on Demand, Pay Per View
<4.11.2Update to 4.11.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field
VideoZen
≤1.0.1No patch available
- Medium4.3Cross-Site Request Forgery
Plugin: CMS für Motorrad Werkstätten
≤1.0.0No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification
Canto
≤3.1.1Update to 3.1.2
- High7.5Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal
Unlimited Elements for Elementor
≤2.0.6Update to 2.0.7
- Medium5.3Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤10.1.0Update to 11.1.1
- Medium4.9Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter
JetBackup – Backup, Restore & Migrate
≤3.1.19.8Update to 3.1.20.3
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.3.2Update to 5.4.0
- Medium6.5Authenticated (Admin+) SQL Injection via 'date' Parameter
Tutor LMS – eLearning and online course solution
≤3.9.8Update to 3.9.9
- Medium5.3Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
Tutor LMS – eLearning and online course solution
≤3.9.8Update to 3.9.9
- Medium5.3Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes
Kubio AI Page Builder
≤2.7.2Update to 2.7.3
- Medium4.9Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.40Update to 1.15.41
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter
wpForo Forum
≤2.4.16Update to 3.0.0
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.4Update to 14.16.5
- High7.2Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤14.16.4Update to 14.16.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1056Update to 1.7.1057
- Medium6.5Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.25Update to 3.7.26
- Medium5.3Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
6.1.21 – 6.1.21Update to 6.2.0
- High8.1Limousine and Car Rental WordPress Theme <= 1.4 - Unauthenticated PHP Object Injection
LuxeDrive - Limousine and Car Rental WordPress Theme
≤1.4Update to 1.5
- High8.1Unauthenticated PHP Object Injection
Laurits - Portfolio and Agency WordPress Theme
≤1.5.1Update to 1.6
- Medium5.3Missing Authorization
Payment Gateway for Redsys & WooCommerce Lite
≤7.0.0Update to 7.0.1
- Medium4.3Missing Authorization
Ultra Addons for WPForms
≤1.0.11Update to 1.0.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1041Update to 1.7.1041
- High8.8Authenticated (Custom+) Arbitrary File Upload
Academy LMS Pro
<3.5.2Update to 3.5.2
- Medium5.3Missing Authorization
HAPPY – Helpdesk Support Ticket System
≤1.0.10Update to 1.0.11
- Medium5.3Missing Authorization
User Registration Stripe
≤1.3.14Update to 1.3.15
- Medium4.3Missing Authorization
Elated Listing
≤1.4Update to 1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
≤2.3.2Update to 2.3.3
- High7.5Authenticated (Contributor+) PHP Object Injection
Events Calendar for GeoDirectory
≤2.3.25Update to 2.3.26