Database
WordPress Vulnerability Database (page 288)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
WP Directory Kit
≤1.5.0Update to 1.5.1
- High8.1Unauthenticated PHP Object Injection
Playroom - Kids & Kindergarten WordPress Theme
≤1.4.1Update to 1.5
- High8.8Authenticated (Subscriber+) Privilege Escalation
MultiLoca - WooCommerce Multi Locations Inventory Management
≤4.2.15Update to 4.2.16
- High8.1Unauthenticated Local File Inclusion
Mikado Core
≤1.6Update to 1.7.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute
OSM – OpenStreetMap
≤6.1.15Update to 6.1.16
- High7.5Unauthenticated SQL Injection
SQL Chart Builder
<2.3.8Update to 2.3.8
- Medium5.3Missing Authorization
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤2.1.5Update to 2.1.6
- High8.1Music WordPress Theme <= 1.7 - Unauthenticated PHP Object Injection
NeoBeat - Music WordPress Theme
≤1.7Update to 1.8
- High8.1Unauthenticated PHP Object Injection
Micdrop - Music WordPress Theme
≤1.3.1Update to 1.4
- High8.1Unauthenticated PHP Object Injection
Konsept - Furniture Store WordPress Theme
≤1.9Update to 2.0
- High8.1Unauthenticated PHP Object Injection
Santé - Organic Shop WordPress Theme
≤1.5.1Update to 1.6
- High7.5Unauthenticated SQL Injection
Simply Schedule Appointments
≤1.6.9.27Update to 1.6.9.29
- High8.1Unauthenticated PHP Object Injection
Fidalgo - Restaurant WordPress Theme
≤1.2.2Update to 1.3
- High8.1Unauthenticated PHP Object Injection
Mildhill - Organic and Food Store WordPress Theme
≤1.5Update to 1.6
- High7.2Authenticated (Shop Manager+) Privilege Escalation
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails
<2.1.0Update to 2.1.0
- High8.1Unauthenticated Local File Inclusion
WaveRide - Surfing and Water Sports WordPress Theme
≤1.4Update to 1.5
- High7.5Unauthenticated SQL Injection
Blocksy Companion Pro
<2.1.29Update to 2.1.29
- High8.1Unauthenticated PHP Object Injection
Zermatt - Agency WordPress Theme
≤1.6.1Update to 1.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting
Experto Dashboard for WooCommerce
≤1.0.4Update to 1.0.5
- Critical9.8Unauthenticated Privilege Escalation
Datalogics Ecommerce Delivery – Datalogics
≤2.6.62Update to 2.6.63
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update
MStore API – Create Native Android & iOS Apps On The Cloud
≤4.18.3Update to 4.18.4
- High8.1Unauthenticated Local File Inclusion
blueprint
<1.1.5Update to 1.1.5
- High8.1Unauthenticated Local File Inclusion
Mr. SEO - Social Media Marketing Agency WordPress Theme
≤2.0Update to 2.1
- High8.1Unauthenticated PHP Object Injection
Hiroshi - Architecture and Interior Design WordPress Theme
≤1.5.1Update to 1.6
- High8.1Unauthenticated Local File Inclusion
Aperitif - Wine Shop and Liquor Store WordPress Theme
≤1.5Update to 1.6
- High8.1Unauthenticated Local File Inclusion
Uppercase - WordPress Blog Theme with Dark Mode
<1.2.2Update to 1.2.2
- High8.1Unauthenticated Local File Inclusion
Solene Core
≤2.3.2Update to 2.3.4
- High8.1Unauthenticated PHP Object Injection
Aperitif - Wine Shop and Liquor Store WordPress Theme
≤1.6Update to 1.6.1
- Critical9.8Backdoor Embedded via Supply Chain Compromise
Smart Slider 3 Pro
3.5.1.35 – 3.5.1.35Update to 3.5.1.36
- High8.1Unauthenticated Local File Inclusion
Solene - Wedding Photography WordPress Theme
≤3.4Update to 3.4.1