Database
WordPress Vulnerability Database (page 302)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Low2.7Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter
Keep Backup Daily
≤2.1.1Update to 2.1.3
- Critical9.8Unauthenticated Privilege Escalation
RewardsWP – Loyalty Points & Referral Program for WooCommerce
≤1.0.4Update to 1.0.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Image Slider by Ays- Responsive Slider and Carousel
≤2.7.1Update to 2.7.2
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Green Downloads
≤2.08Update to 2.09
- Medium4.3Missing Authorization
Comments Import & Export
≤2.4.9Update to 2.5.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title
Keep Backup Daily
≤2.1.2Update to 2.1.3
- Medium5.3Missing Authorization
Membership Plugin – Kadence Memberships
≤3.2.22Update to 3.2.23
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
WPJAM Basic
≤6.9.2Update to 6.9.2.1
- Medium6.1Reflected Cross-Site Scripting
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.1.4Update to 5.1.5
- High7.5Authenticated (Subscriber+) Local File Inclusion
Gallery by Visual Portfolio
≤3.5.1Update to 3.5.2
- High7.5Unauthenticated SQL Injection
Product Designer for WooCommerce WordPress | Lumise
<2.0.9Update to 2.0.9
- Medium6.1Reflected Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤26.7Update to 26.8
- High8.1Unauthenticated Local File Inclusion
Feedy - Healthy Fast Food Delivery & Diet Nutrition WordPress Theme
<2.1.5Update to 2.1.5
- Medium4.3Missing Authorization
New User Approve
≤3.2.3Update to 3.2.4
- High8.1Unauthenticated PHP Object Injection
Pelicula - Video Production and Movie WordPress Theme
<1.10Update to 1.10
- Medium6.1Reflected Cross-Site Scripting
mydecor
<1.5.9Update to 1.5.9
- High8.1Unauthenticated Local File Inclusion
Trendustry - Industrial & Manufacturing WordPress
≤1.1.4Update to 1.1.5
- Medium4.3Missing Authorization
Premmerce Redirect Manager
≤1.0.12Update to 1.0.13
- Medium6.1Reflected Cross-Site Scripting
Yobazar - Elementor Fashion WooCommerce Theme
<1.6.7Update to 1.6.7
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field
iTracker360
≤2.2.0Update to 2.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value
Autoptimize
≤3.1.14Update to 3.1.15
- Medium6.1eCommerce HTML5 Template < 1.5.19 - Reflected Cross-Site Scripting
Molla - eCommerce HTML5 Template
<1.5.19Update to 1.5.19
- Medium5.3Missing Authorization
WP Terms Popup – Terms and Conditions and Privacy Policy WordPress Popups
≤2.10.0Update to 2.11.0
- Medium5.3Multi Vendor Online Music Store Elementor WordPress Theme < 2.1.2 - Missing Authorization
Miraculous - Multi Vendor Online Music Store Elementor WordPress Theme
<2.1.2Update to 2.1.2
- High8.1Unauthenticated Local File Inclusion
StreamVid - Movie Video Streaming WordPress Theme
<6.8.6Update to 6.8.6
- High8.1Unauthenticated Local File Inclusion
LoveDate - Social Dating Network WordPress Theme
<3.8.6Update to 3.8.6
- Medium6.5Authenticated (Editor+) Arbitrary File Deletion
Spam Protect for Contact Form 7
≤1.2.9Update to 1.2.10
- Medium6.1Reflected Cross-Site Scripting
Reebox - Elementor WooCommerce WordPress Theme
<1.4.8Update to 1.4.8
- Medium6.5Authenticated (Subscriber+) SQL Injection
Miraculous Core
<2.1.2Update to 2.1.2
- Medium5.3Unauthenticated Insecure Direct Object Reference to Wishlist Rename
YITH WooCommerce Wishlist
<4.13.0Update to 4.13.0