Database
WordPress Vulnerability Database (page 296)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Gaea - Environmental WordPress Theme
<3.8Update to 3.8
- Critical9.8Unauthenticated Remote Code Execution
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤4.4.9Update to 5.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
WP REST Cache
≤2026.1.0Update to 2026.1.1
- High7.5Unauthenticated SQL Injection
Noo JobMonster
<4.8.4Update to 4.8.4
- Medium6.1Reflected Cross-Site Scripting
VikRestaurants Table Reservations and Take-Away
≤1.5.2Update to 1.5.3
- High8.1Unauthenticated PHP Object Injection
Gracey
<1.4Update to 1.4
- High7.5Unauthenticated SQL Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
<1.15.38Update to 1.15.38
- High8.1Unauthenticated Local File Inclusion
NaturaLife Extensions
≤2.1Update to 2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Lead Form Builder & Contact Form
≤2.0.1Update to 2.0.2
- High8.1Unauthenticated PHP Object Injection
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.26Update to 1.6.27
- Medium4.3Missing Authorization
Contact Form Email
≤1.3.63Update to 1.3.64
- Medium4.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.6.0Update to 2.6.1
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
WPBookit Pro - Appointment Booking Plugin for WordPress
≤1.6.18No patch available
- Medium4.3Authenticated (Subscriber+) Privilege Escalation
WPBookit Pro - Appointment Booking Plugin for WordPress
≤1.6.18No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
RSFirewall!
≤1.1.45Update to 1.1.46
- Medium6.5Authenticated (Shop Manager+) Arbitrary File Deletion
YML for Yandex Market
<5.3.0Update to 5.3.0
- Medium6.1City Travel Guide WordPress Theme < 1.7.5 - Reflected Cross-Site Scripting
Golo - City Travel Guide WordPress Theme
<1.7.5Update to 1.7.5
- Medium5.3Missing Authorization
Team – Team Members Showcase Plugin
≤5.0.11Update to 5.0.12
- Medium6.1Reflected Cross-Site Scripting
WP Telegram Widget and Join Link
≤2.2.13Update to 2.2.14
- Medium5.3Missing Authorization
HIPAA Forms
≤3.1.0Update to 3.2.0
- Medium5.3Missing Authorization
Coinbase Business Gateway for WooCommerce
<2.0.0Update to 2.0.0
- High8.1Unauthenticated PHP Object Injection
Tasty Daily - Grocery Store & Food WooCommerce Theme
<1.27Update to 1.27
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP TripAdvisor Review Slider
≤14.1Update to 14.2
- Medium6.1Reflected Cross-Site Scripting
JobSearch WP Job Board
≤3.2.0Update to 3.2.2
- High8.1Unauthenticated PHP Object Injection
Borgholm - Marketing Agency Wordpress Theme
<1.6Update to 1.6
- Medium4.3Missing Authorization
The Grid
<2.8.0Update to 2.8.0
- Medium5.3Missing Authorization
Helpdesk Support Ticket System for WooCommerce
≤2.1.2Update to 2.1.3
- Medium5.3Unauthenticated Information Exposure
DirectoryPress – Business Directory And Classified Ad Listing
≤3.6.26Update to 3.6.27
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
JS Help Desk – AI-Powered Support & Ticketing System
≤3.0.3Update to 3.0.4
- High8.1Unauthenticated PHP Object Injection
Woodmart
≤8.3.8Update to 8.3.9