Database
WordPress Vulnerability Database (page 297)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
Stål - Industry WordPress Theme
<1.7Update to 1.7
- Medium6.1Reflected Cross-Site Scripting
KiviCare – Clinic & Patient Management System (EHR)
≤3.6.16Update to 4.0.0
- Medium6.1Reflected Cross-Site Scripting
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported )
<2.4.6Update to 2.4.6
- High8.1Unauthenticated PHP Object Injection
Halstein - Business Consulting WordPress Theme
<1.8Update to 1.8
- High7.5Authenticated (Subscriber+) PHP Object Injection
Meloo - Music Theme for WordPress
<2.8.2Update to 2.8.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
sanzo
<2.4.3Update to 2.4.3
- Medium6.1Reflected Cross-Site Scripting
Addon Jobsearch Chat
≤3.0Update to 3.1
- High7.2Unauthenticated Stored Cross-Site Scripting
oopspam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)
≤1.2.62Update to 1.2.63
- High8.1Unauthenticated PHP Object Injection
Archicon - Architecture and Construction WordPress Theme
<1.7Update to 1.7
- Medium5.3Missing Authorization
KiviCare – Clinic & Patient Management System (EHR)
≤3.6.16Update to 4.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Themesflat Addons For Elementor
≤2.3.2Update to 2.3.3
- Medium5.3Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.2.8Update to 4.2.9
- Medium5.3Unauthenticated Path Traversal
File Uploader for WooCommerce
≤1.0.4No patch available
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.2.6Update to 5.2.7
- Medium4.9Authenticated (Shop manager+) SQL Injection
FOX – Currency Switcher Professional for WooCommerce
≤1.4.5Update to 1.4.6
- Medium4.3Missing Authorization
PPWP – Password Protect Pages
≤1.9.15Update to 1.9.16
- Medium5.3Missing Authorization
Tutor LMS Pro
≤3.9.8Update to 3.9.9
- High8.8Authenticated (Contributor+) Remote Code Execution
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
≤2.7.1Update to 2.7.2
- Medium4.9Authenticated (Editor+) SQL Injection
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.4.2Update to 8.5.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Review Slider
≤13.9Update to 14.0
- Medium5.3Unauthenticated Sensitive Information Exposure
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤1.9.8.7Update to 1.9.9.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤3.2.26Update to 3.2.27
- Medium5.3Missing Authorization
Indeed Membership Pro
≤13.7Update to 13.7.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
The Grid
<2.8.0Update to 2.8.0
- Medium6.1Reflected Cross-Site Scripting
Gyan Elements
≤2.2.1Update to 2.2.2
- High7.5Authenticated (Subscriber+) PHP Object Injection
Apicona - Health & Medical WordPress Theme
≤24.1.0No patch available
- Medium4.3Missing Authorization
Vertex Addons for Elementor
≤1.6.4Update to 1.7.0
- Medium4.9Authenticated (Administrator+) SQL Injection
OttoKit: All-in-One Automation Platform
≤1.1.20Update to 1.1.21
- High8.1Business Consulting WordPress Theme < 1.4 - Unauthenticated PHP Object Injection
Leroux - Business Consulting WordPress Theme
<1.4Update to 1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'unset' Attribute
DSGVO snippet for Leaflet Map and WP GPX Maps
≤3.1Update to 3.4