Database
WordPress Vulnerability Database (page 304)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Product Rearrange for WooCommerce
≤1.2.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Jaroti - Elementor Accessories WooCommerce Theme
<1.4.8Update to 1.4.8
- High8.1Unauthenticated Local File Inclusion
Kunco - Charity & Fundraising WordPress Theme
<1.4.5Update to 1.4.5
- Medium6.1Reflected Cross-Site Scripting
Taboola Pixel
≤1.1.4Update to 1.1.5
- Critical9.1Unauthenticated Arbitrary File Deletion
WooCommerce Support Ticket System
<18.5Update to 18.5
- High7.5Authenticated (Subscriber+) PHP Object Injection
Pendulum - Beat Producers, DJs & Events Theme for WordPress
<3.1.5Update to 3.1.5
- High7.5Unauthenticated SQL Injection
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤7.7.9Update to 7.8.0
- Medium6.5Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter
ilGhera Carta Docente for WooCommerce
≤1.5.0Update to 1.5.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels
CM Custom Reports – Flexible reporting to track what matters most
≤1.2.7Update to 1.2.8
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions
RockPress
≤1.0.17Update to 1.0.18
- Critical9.8Unauthenticated Privilege Escalation via Arbitrary Function Call
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit
≤2.7.5Update to 2.7.6
- Medium4.3Unvalidated Redirect in Password Reset Flow via rcp_redirect
Membership Plugin – Kadence Memberships
≤3.2.24Update to 3.2.25
- High7.2Authenticated (Shop Manager+) Remote Code Execution
YML for Yandex Market
<5.0.26Update to 5.0.26
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Nelio Content – Editorial Calendar & Social Media Auto-Posting
≤4.3.1Update to 4.3.2
- Medium5.3Missing Authorization
Sprout Invoices – Client Invoicing & Estimates
≤20.8.10Update to 20.8.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Get Use APIs – JSON Content Importer
<2.0.10Update to 2.0.10
- High7.5Unauthenticated SQL Injection via 'fields' Parameter
Simply Schedule Appointments
≤1.6.10.0Update to 1.6.10.2
- Medium5.3Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter
Instant Popup Builder – Popup Maker for Videos, Forms, Offers, Announcements, Galleries & Exit Intent
≤1.1.7Update to 1.1.8
- Medium4.3Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter
Add Custom Fields to Media
≤2.0.3Update to 2.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter
Draft List
≤2.6.2Update to 2.6.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Booking calendar, Appointment Booking System
≤3.2.36No patch available
- Medium6.1Reflected Cross-Site Scripting
Unlimited Addons For Gutenberg Blocks
≤1.2.8Update to 1.2.9
- Medium4.3Missing Authorization
WPVulnerability
≤4.2.1Update to 4.2.1.1
- Medium6.1Reflected Cross-Site Scripting
Phox - Hosting WordPress & WHMCS Theme
≤2.0.8Update to 2.0.9
- Medium4.3Missing Authorization
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
≤1.2.2Update to 1.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
Info Cards – Add Text and Media in Card Layouts
≤2.0.7Update to 2.0.8
- High7.5Unauthenticated Information Epxosure
ActivityPub
<8.0.2Update to 8.0.2
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Wishlist Member
≤3.32.0Update to 3.33.0
- High7.5Unauthenticated SQL Injection
Advanced Reporting and Statistics for WooCommerce
≤4.1.3Update to 4.1.4
- Medium4.3Missing Authorization
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets
≤4.0.21Update to 4.0.22