Database
WordPress Vulnerability Database (page 303)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Recarto – Abandoned Cart Recovery for WooCommerce
≤1.1.10Update to 1.1.11
- Medium4.3Missing Authorization
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
≤1.1.5Update to 1.1.6
- High7.5Authenticated (Contributor+) PHP Object Injection
JS Archive List
≤6.1.7Update to 6.2.0
- High7.5Unauthenticated Information Exposure
SMTP Mailer
≤1.1.24Update to 1.1.25
- Critical9.1Multipurpose WordPress theme < 1.5.16 - Unauthenticated Arbitrary File Deletion
Scape - Multipurpose WordPress theme
<1.5.16Update to 1.5.16
- High7.5Authenticated (Subscriber+) PHP Object Injection
Vex
<1.2.9Update to 1.2.9
- Medium5.3Missing Authorization
Bit SMTP – Easy SMTP Solution with Email Logs
≤1.2.2Update to 1.2.3
- High8.8Authenticated (Author+) Arbitrary File Upload
Photo Engine (Media Organizer & Lightroom)
≤6.4.9Update to 6.5.0
- High7.5Unauthenticated SQL Injection
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
≤3.7.23Update to 3.7.24
- Medium6.1Reflected Cross-Site Scripting
Loobek - Elementor Multipurpose WooCommerce Theme
<1.5.2Update to 1.5.2
- High8.8Authenticated (Contributor+) Privilege Escalation
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators
≤1.1.18Update to 1.1.19
- High7.2Unauthenticated Stored Cross-Site Scripting
FAQ Builder AYS
≤1.8.2Update to 1.8.3
- High7.5Unauthenticated SQL Injection
Product Rearrange for WooCommerce
≤1.2.2No patch available
- Medium6.1Reflected Cross-Site Scripting
nooni
<1.5.1Update to 1.5.1
- High7.2Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API
WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation
≤1.4.29Update to 1.4.30
- Medium5.3Missing Authorization
My Tickets – Accessible Event Ticketing
≤2.1.1Update to 2.1.2
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1132Update to 4.1133
- Medium6.1Reflected Cross-Site Scripting
Motta Addons
<1.6.1Update to 1.6.1
- Medium6.1Reflected Cross-Site Scripting
Riode | Multi-Purpose WooCommerce
<1.6.29Update to 1.6.29
- Medium6.1Reflected Cross-Site Scripting
Miti - Elementor Fashion WooCommerce Theme
<1.5.3Update to 1.5.3
- High8.1Unauthenticated Local File Inclusion
IdealAuto - Car Dealer & Services WordPress Theme
<3.8.6Update to 3.8.6
- Medium6.5Authenticated (Subscriber+) SQL Injection
JS Help Desk – AI-Powered Support & Ticketing System
≤3.0.3Update to 3.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes
Autoptimize
≤3.1.14Update to 3.1.15
- High8.1Unauthenticated Local File Inclusion
MetaMax
≤1.1.4Update to 1.1.5
- High8.1Unauthenticated Local File Inclusion
VintWood - Vintage, Retro WordPress Theme
≤1.1.8Update to 1.1.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Custom Admin Interface
≤7.42Update to 7.43
- Medium5.3Missing Authorization
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.7.6Update to 6.0.7.7
- Medium4.3Missing Authorization
Kargo Takip, WooCommerce & Dokan Kargo Takip, SMS ve E-posta
<0.2.4Update to 0.2.4
- Medium6.1Reflected Cross-Site Scripting
MyMedi - Responsive WooCommerce WordPress Theme
<1.7.7Update to 1.7.7
- Medium6.1Reflected Cross-Site Scripting
Avada (Fusion) Builder
<3.15.0Update to 3.15.0