Database
WordPress Vulnerability Database (page 307)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Unlimited Elements for Elementor (Premium)
≤1.4.72No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
Jobica Core
≤1.4.1Update to 1.4.2
- Low3.7Missing Authorization
LearnPress – Sepay Payment
≤4.0.0Update to 4.0.1
- Medium5.3Missing Authorization
Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
≤1.2.9Update to 1.3.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤2.1.3Update to 2.1.4
- Medium5.3Missing Authorization
Modern Events Calendar
≤7.32.0Update to 7.33.0
- Critical9.8Custom Post Types Plugin for WordPress <= 2.0.47 - Unauthenticated Remote Code Execution
ACPT (Premium)
≤2.0.47No patch available
- Medium6.5Authenticated (Contributor+) SQL Injection
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.1Update to 4.7.2
- High8.1Wordpress Plugin <= 14.0.31 - Authenticated (Subscriber+) Arbitrary File Deletion
WooCommerce Amazon Affiliates - Wordpress Plugin
≤14.0.31No patch available
- High8.1Unauthenticated Local File Inclusion
The Aisle Core
≤2.0.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Flexmls® IDX Plugin
≤3.15.9Update to 3.15.10
- High7.2Authenticated (Editor+) Arbitrary File Upload
photography
≤7.7.5No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Organici Library
≤2.1.2Update to 2.1.3
- High8.8Authenticated (Contributor+) Remote Code Execution
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.0.12Update to 4.0.13
- High7.5Real Estate WordPress Theme <= 3.7.1 - Authenticated (Subscriber+) PHP Object Injection
Support for CitiLights - Real Estate WordPress Theme
≤3.7.1Update to 3.7.2
- Medium4.3Missing Authorization
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤4.2.4Update to 4.2.5
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Tutor LMS – eLearning and online course solution
≤3.9.4Update to 3.9.5
- High7.5Authenticated (Subscriber+) PHP Object Injection
sb-woocommerce-infinite-scroll
≤1.6.2No patch available
- Medium5.3Missing Authorization to Unauthenticated Settings Change
ViaBill – WooCommerce
<1.1.70Update to 1.1.70
- High7.5Authenticated (Subscriber+) PHP Object Injection
Visionary Core
≤1.4.9Update to 1.5.0
- High8.1Newspaper Magazine News BuddyPress AMP <= 7.6.4 - Unauthenticated Local File Inclusion
Jannah - Newspaper Magazine News BuddyPress AMP
≤7.6.4Update to 7.6.5
- Medium6.1Reflected Cross-Site Scripting
tagDiv Opt-In Builder
≤1.7.3Update to 1.7.4
- Medium4.3Missing Authorization
Tutor LMS – eLearning and online course solution
≤3.9.7Update to 3.9.8
- Medium4.3Missing Authorization
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.5.7Update to 9.5.8
- Medium4.9Authenticated (Shop manager+) SQL Injection
YayMail – WooCommerce Email Customizer
≤4.3.3Update to 4.3.4
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.2.8Update to 4.2.9
- High7.5Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.1.9Update to 9.1.10
- Medium4.3Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion
Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types
≤4.1.0Update to 4.1.1
- Medium5.3Missing Authorization to Unauthenticated Private Course Disclosure
Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor
≤1.3.7Update to 1.3.8
- Medium5.3Unauthenticated Insecure Direct Object Reference
COMPE – WooCommerce Compare Products
≤1.1.4Update to 1.1.5