Database
WordPress Vulnerability Database (page 306)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via 'event_type'
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤3.8.0Update to 3.9.0
- Medium5.3Missing Authorization
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
≤4.10.1Update to 4.11.0
- Medium5.3Missing Authorization
avalex – Automatisch sichere Rechtstexte
≤3.1.3Update to 3.1.4
- Medium6.1Reflected Cross-Site Scripting
UpSolution Core
≤8.41Update to 8.42
- High7.3Unauthenticated Authentication Bypass via Social Login Token
KiviCare – Clinic & Patient Management System (EHR)
≤4.1.2Update to 4.1.3
- Medium4.3Missing Authorization
Product Slider, Product Grid, Product Masonry
≤1.13.61Update to 1.13.62
- Medium4.3Missing Authorization
Activity Log for WordPress
≤1.2.7Update to 1.2.8
- Medium4.3Missing Authorization
Ave Core
≤2.9.1No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
CP Multi View Events Calendar
≤1.4.39Update to 1.4.40
- High7.2Unauthenticated Stored Cross-Site Scripting
Remoji – Post/Comment Reaction and Enhancement
≤2.2Update to 2.4
- High8.1Unauthenticated PHP Object Injection
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.2.8.0Update to 4.2.8.1
- High8.1Unauthenticated PHP Object Injection
Travel Booking WordPress Theme
<3.2.8.1Update to 3.2.8.1
- High8.2Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
KiviCare – Clinic & Patient Management System (EHR)
≤4.1.2Update to 4.1.3
- Medium5.3Unauthenticated Information Exposure
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤8.2.8Update to 8.3.0
- Medium5.3Missing Authorization
Automated FedEx live/manual rates with shipping labels – HPOS supported
≤5.1.8No patch available
- High8.1Unauthenticated Local File Inclusion
Mixtape
≤2.1No patch available
- Medium5.3Missing Authorization
Education Zone
≤1.3.8Update to 1.3.9
- Medium5.3Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1049Update to 1.7.1050
- High7.5Unauthenticated SQL Injection via 'search' Parameter
WowStore – Store Builder & Product Blocks for WooCommerce
≤4.4.3Update to 4.4.4
- High7.5Authenticated (Subscriber+) PHP Object Injection
Organici Library
≤2.1.2Update to 2.1.3
- Medium6.5Wordpress Plugin <= 14.0.31 - Authenticated (Subscriber+) SQL Injection
WooCommerce Amazon Affiliates - Wordpress Plugin
≤14.0.31No patch available
- Medium6.1Real Estate WordPress Theme <= 3.7.1 - Reflected Cross-Site Scripting
Support for CitiLights - Real Estate WordPress Theme
≤3.7.1Update to 3.7.2
- Medium6.1Reflected Cross-Site Scripting
Visionary Core
≤1.4.9Update to 1.5.0
- Medium4.3Missing Authorization
StoreCustomizer – A plugin to Customize all WooCommerce Pages
≤2.6.3Update to 2.6.5
- Medium6.1Reflected Cross-Site Scripting
Jobica Core
≤1.4.1Update to 1.4.2
- Medium6.1Reflected Cross-Site Scripting
Organici Library
≤2.1.2Update to 2.1.3
- Medium4.3Missing Authorization
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.2.11Update to 4.2.12
- Medium5.3Missing Authorization
Jobica Core
≤1.4.2No patch available
- High8.8Authenticated (Contributor+) Remote Code Execution
TotalPoll for Polls and Contests
≤4.12.0No patch available
- High8.1Unauthenticated Local File Inclusion
Curly Core
≤2.1.6Update to 2.2.2