Database
WordPress Vulnerability Database (page 313)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via 'date_from' and 'date_to' Parameters
CM Custom Reports – Flexible reporting to track what matters most
≤1.2.7Update to 1.2.8
- Medium4.8Authenticated (Administrator+) Stored Cross-Site Scripting via Template
Stock Ticker
≤3.26.1Update to 3.26.2
- High7.2Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting
Easy PHP Settings
≤1.0.4Update to 1.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute
Hammas Calendar
≤1.5.11Update to 1.5.12
- Medium4.3Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection
WP Frontend Profile
≤1.3.8Update to 1.3.9
- Medium5.3Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'
Greenshift – animation and page builder blocks
≤12.8.3Update to 12.8.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
HUMN-1 AI Website Scanner & Human Certification by Winston AI
≤0.0.3Update to 0.0.4
- High8.1Unauthenticated Local File Inclusion
NeoBeat - Music WordPress Theme
≤1.2Update to 1.7
- High8.1Event Planning & Wedding WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion
Unica - Event Planning & Wedding WordPress Theme
≤1.4.1No patch available
- High8.8Missing Authorization to (Subscriber+) Arbitrary Plugin Installation/Activation
Restaurant Cafeteria
≤0.4.6No patch available
- High8.1Vegetarian Food Festival & Eco Event WordPress Theme <= 1.2.0 - Unauthenticated Local File Inclusion
VegaDays - Vegetarian Food Festival & Eco Event WordPress Theme
≤1.2.0No patch available
- Medium4.3Missing Authorization
Embed Plus for YouTube Gallery, Livestream and Lazy Loading with Facades
≤14.2.4Update to 14.2.5
- High8.1Unauthenticated Local File Inclusion
Roisin - Flower Shop and Florist WordPress Theme
≤1.2.1Update to 1.4
- High8.1Unauthenticated Local File Inclusion
Amoli - Fashion Photography WordPress Theme
≤1.0Update to 1.1
- Medium5.3Missing Authorization
Starter Templates & Sites Pack by ThemeGrill
≤2.0.0.6Update to 2.0.0.7
- High8.1Unauthenticated Local File Inclusion
Wizor's | Investments, Economics & Bankin WordPress Theme
≤2.12No patch available
- Medium5.3Unauthenticated Sensitive Information Exposure via Settings Backup
Greenshift – animation and page builder blocks
≤12.8.3Update to 12.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Greenshift – animation and page builder blocks
≤12.8.5Update to 12.8.6
- High8.1Unauthenticated Arbitrary File Upload
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.9.5Update to 1.3.9.6
- High8.1Unauthenticated Local File Inclusion
Mr. Cobbler | Custom Shoemaking & Footwear Repairs WordPress Theme
≤1.1.9No patch available
- High8.1Unauthenticated Local File Inclusion
Triompher | Golf Course & Sports Club WordPress Theme
≤1.1.0No patch available
- High8.1Unauthenticated Local File Inclusion
Tour Booking WordPress Theme - Tripgo
<1.5.6Update to 1.5.6
- High8.1Unauthenticated PHP Object Injection
m2 | Construction and Tools Store WordPress Theme
≤1.1.2No patch available
- High8.1Unauthenticated Local File Inclusion
Gaspard - Restaurant and Coffee Shop WordPress Theme
≤1.3No patch available
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
My Album Gallery
≤1.0.4No patch available
- High8.1Unauthenticated Local File Inclusion
Good Homes - Real Estate WordPress Theme
≤1.3.13No patch available
- Medium6.1Reflected Cross-Site Scripting
My auctions allegro
≤4.0.2Update to 4.0.3
- Medium5.3Unauthenticated Information Disclosure
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
<1.19.5Update to 1.19.5
- Medium4.3Authenticated (Customer+) Insecure Direct Object Reference
Subscriptions for WooCommerce with Stripe Recurring Payments
≤1.8.10Update to 1.8.11
- High8.1Unauthenticated Local File Inclusion
Greenville | Private School & University Education WordPress Theme
≤1.3.2No patch available