Database
WordPress Vulnerability Database (page 311)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Zorka – Wonderful Fashion WooCommerce Theme
≤1.5.7No patch available
- High7.5Authenticated (Author+) PHP Object Injection
Photo Contest | Competition | Video Contest
≤2.9.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Ultra Admin
≤11.7No patch available
- High8.1Unauthenticated PHP Object Injection
Work & Travel Company - Youth Programs Theme
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Darna Framework
≤2.9No patch available
- Medium4.3Cross-Site Request Forgery via postConfirmOauth
Modular DS: Monitor, update, and backup multiple websites
≤2.5.1Update to 2.6.0
- High8.1Unauthenticated Local File Inclusion
Belfort - Single Property and Apartment WordPress Theme
≤1.0Update to 1.2
- High8.1Unauthenticated PHP Object Injection
Buisson - Gardening WordPress Theme
≤1.1.11No patch available
- High8.1Flower Shop and Florist WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion
Rosebud - Flower Shop and Florist WordPress Theme
≤1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
tagDiv Composer
≤5.4.2Update to 5.4.3
- Medium5.3Missing Authorization
Addi – Cuotas que se adaptan a ti
≤2.0.4Update to 2.1.0
- Critical9.1Unauthenticated Arbitrary File Deletion
PitchPrint
≤11.1.2Update to 11.2.0
- Medium4.36.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
WordPress
6.9 – 6.9.1Update to 6.9.2
- Medium4.3Missing Authorization
UiPress lite | Effortless custom dashboards, admin themes and pages
≤3.5.09Update to 3.5.10
- Medium6.5Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress
≤6.9.1Update to 6.8.4 or 6.9.2
- High8.1Unauthenticated Local File Inclusion
MultiOffice - Coworking Space WordPress Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
Deston - Corporate Business WordPress Theme
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery
WooCommerce
<10.5.3Update to 10.5.3
- High8.1Unauthenticated Local File Inclusion
LuxeDrive - Limousine and Car Rental WordPress Theme
≤1.0Update to 1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Lead Form Builder & Contact Form
≤2.0.1Update to 2.0.2
- Medium5.3Missing Authorization
News Magazine X
≤1.2.50Update to 1.2.51
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode
NextScripts: Social Networks Auto-Poster
≤4.4.6Update to 4.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Entry Fields
Unlimited Elements for Elementor
≤2.0.5Update to 2.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
MetForm Pro
≤3.9.6Update to 3.9.7
- Critical9.8Authentication Bypass via Social Login
Tutor LMS Pro
≤3.9.5Update to 3.9.6
- High7.5Authenticated (Author+) Arbitrary File Read via ajax_create_import
The Events Calendar
≤6.15.17Update to 6.15.17.1
- Medium5.3Missing Authorization to Get Items via REST API endpoints
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.16Update to 1.0.17
- Medium5.3Missing Authorization to Addon Plugin Installation
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.16Update to 1.0.17
- High8.1Unauthenticated PHP Object Injection
Melody - Arts Courses & Music School WordPress Theme
≤1.6.3No patch available
- High8.1Unauthenticated PHP Object Injection
Beelove | Honey Production and Sweets Online Store WordPress Theme
≤1.2.6No patch available