Database
WordPress Vulnerability Database (page 310)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.27Update to 1.6.28
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
WP ULike – Like Buttons, Voting & Engagement Analytics
≤5.0.1Update to 5.0.2
- High7.5Unauthenticated SQL Injection via URL Path
Web Accessibility (formally known as Ally) – WCAG Scanning, Guided Fixes, Usability Widget
≤4.0.3Update to 4.1.0
- High8.8Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1049Update to 1.7.1050
- High8.1Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.16.11Update to 4.16.12
- Medium6.5Missing Authorization to Unauthenticated Arbitrary Subscription Deletion
MC4WP: Mailchimp for WordPress
≤4.11.1Update to 4.12.0
- Medium6.1Reflected Cross-Site Scripting via 'themebuilder' Parameter
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤1.6.8Update to 2.0.0
- Medium6.1Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.2.7Update to 5.2.8
- Medium6.4Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
≤2.4.20Update to 2.4.27
- Medium5.3Missing Authorization
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.2.6.0Update to 4.2.7.0
- High8.1Unauthenticated Local File Inclusion
Amfissa - Organic Olive Shop WordPress Theme
≤1.1Update to 1.2.1
- Medium4.3Missing Authorization
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.2.5Update to 4.2.6
- Medium6.1Reflected Cross-Site Scripting
Wolverine Framework
≤1.9No patch available
- Medium5.3Missing Authorization
Job Postings
≤2.8Update to 2.8.1
- Medium4.3Cross-Site Request Forgery
Admin Menu Editor
≤1.14.1Update to 1.15
- Medium5.3Missing Authorization
Avada (Fusion) Builder
<3.15.0Update to 3.15.0
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤28.1.2.1Update to 28.1.2.2
- High8.1Unauthenticated Local File Inclusion
Emaurri - Architecture and Interior Design WordPress Theme
≤1.0.1Update to 1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Avada Core
<5.15.0Update to 5.15.0
- Medium5.3Missing Authorization
Avada Core
<5.15.0Update to 5.15.0
- Medium4.3Missing Authorization
Avada (Fusion) Builder
<3.15.0Update to 3.15.0
- High8.1Unauthenticated PHP Object Injection
Love Story | Wedding and Event Planner WordPress Theme
≤1.3.12No patch available
- Medium4.3Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint
WordPress
≤6.9.1Update to 6.8.4 or 6.9.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'
Name Directory
≤1.32.1Update to 1.33.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Active Woot Products Tables for WooCommerce. 100% FREE
≤1.0.7Update to 1.0.8
- Medium6.1Reflected Cross-Site Scripting
Legacy Admin
≤9.5No patch available
- Medium5.8Unauthenticated Blind Server-Side Request Forgery via XML-RPC Pingback Discovery
WordPress
≤6.9.1Update to 6.8.4 or 6.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MDTF – Meta Data and Taxonomies Filter
≤1.3.5Update to 1.3.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items
WordPress
≤6.9.1Update to 6.8.4 or 6.9.2
- Medium4.4Cross-Site Scripting via Client-Side Template Override in Admin Area
WordPress
≤6.9.1Update to 6.8.4 or 6.9.2