Database
WordPress Vulnerability Database (page 283)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Contributor+) Privilege Escalation
bBlocks – Essential Gutenberg Blocks & Patterns Collection
≤2.0.31Update to 2.0.32
- Medium5.3Unauthenticated Denial of Service
My Calendar – Accessible Event Manager
<3.7.7Update to 3.7.7
- High8.1Unauthenticated PHP Object Injection
ShiftUp - Car Repair & Auto Services WordPress Theme
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
MagOne
≤9.0Update to 9.1
- Medium4.3Missing Authorization
MyRewards
≤5.7.3Update to 5.7.4
- High8.1Authenticated (Sales Representative+) Arbitrary File Deletion
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.4Update to 4.4.1
- High8.1Unauthenticated Local File Inclusion
ChapterOne - Bookstore and Publisher WordPress Theme
≤1.7Update to 1.8
- High8.1Unauthenticated PHP Object Injection
Reina - Spa and Wellness WordPress Theme
≤2.1Update to 2.2
- High8.1Artist Portfolio WordPress Theme <= 1.4.1 - Unauthenticated PHP Object Injection
Eldon - Artist Portfolio WordPress Theme
≤1.4.1Update to 1.5
- Medium6.1Reflected Cross-Site Scripting
WPZOOM Addons for Elementor – Starter Templates & Widgets
≤1.3.4Update to 1.3.5
- Medium6.5Authenticated (CP Client+) Arbitrary File Download
Client Portal Pro
≤5.6.2Update to 5.6.3
- High8.12.0.5 - Unauthenticated PHP Object Injection
WooCommerce Product Filters
2.0.0 – 2.0.5Update to 2.0.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Shipment Tracker for Woocommerce
≤1.5.3.2Update to 1.5.3.3
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Title
Better Find and Replace – AI-Powered Suggestions
≤1.7.9Update to 1.8.0
- Low3.1Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'
OneSignal – Web Push Notifications
≤3.8.0Update to 3.8.1
- High7.5Unauthenticated SQL Injection via 'packages'
DirectoryPress – Business Directory And Classified Ad Listing
≤3.6.26Update to 3.6.27
- Medium5.3Missing Authorization to Limited Post Meta Modification
Post Grid Gutenberg Blocks – PostX
≤5.0.5Update to 5.0.6
- High8.8Cross-Site Request Forgery to Arbitrary File Deletion
Career Section
≤1.6Update to 1.7
- High7.2Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcode
Prismatic
≤3.7.3Update to 3.7.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.3.8Update to 4.3.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via eeb_mailto Shortcode
Email Encoder – Protect Email Addresses and Phone Numbers
≤2.4.4Update to 2.4.5
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings
Livemesh Addons by Elementor
≤9.0No patch available
- High8.8Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter
Livemesh Addons by Elementor
≤9.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.8.7Update to 4.8.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting
OPEN-BRAIN
≤0.5.0No patch available
- Medium6.1Reflected Cross-Site Scripting via 'crsearch'
Customer Reviews for WooCommerce
≤5.101.0Update to 5.102.0
- Medium5.3Missing Authorization to Unauthenticated Default Map Coordinate Update
Basic Google Maps Placemarks
≤1.10.7Update to 1.10.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting
Custom New User Notification
≤1.2.0No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter
Accessibility Suite by Ability, Inc
≤4.20No patch available
- High7.5Unauthenticated SQL Injection via 'options' Parameter Keys in product_data
Riaxe Product Customizer
≤2.1.2No patch available