Database
WordPress Vulnerability Database (page 314)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Local File Inclusion
ProLingua | Translation Bureau & Interpreting Services WordPress Theme
≤1.1.12No patch available
- High8.1Unauthenticated Local File Inclusion
Dentalux | Dentist & Healthcare Site Template
≤3.3No patch available
- High8.1Psychologist Theme <= 1.2.10 - Unauthenticated Local File Inclusion
Hypnotherapy - Psychologist Theme
≤1.2.10No patch available
- Medium6.1Reflected Cross-Site Scripting via 'filepath'
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
≤4.0.0Update to 4.0.1
- High8.1Unauthenticated PHP Object Injection
Bus Ticket Booking with Seat Reservation
≤5.6.2Update to 5.9.0
- High7.5Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.5.0 - Unauthenticated SQL Injection
Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme
≤1.5.0No patch available
- High8.1Elegant Restaurant WordPress Theme <= 3.1 - Unauthenticated Local File Inclusion
Laurent - Elegant Restaurant WordPress Theme
≤3.1No patch available
- High8.1Unauthenticated Local File Inclusion
Lella - Hairdresser and Beauty Salon WordPress Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
nelson
≤1.2.0No patch available
- High8.1Music Sound Studio WordPress Theme <= 1.2 - Unauthenticated PHP Object Injection
Morning Records - Music Sound Studio WordPress Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
Gioia - Modern Fashion Shop WordPress Theme
≤1.4No patch available
- Medium6.6Authenticated (Shop manager+) PHP Object Injection
WebToffee WooCommerce Product Feeds – Google Shopping, Pinterest, TikTok Ads, & More
≤2.3.3Update to 2.3.4
- Medium4.3Cross-Site Request Forgery
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
≤13.5.2Update to 13.5.2.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter
Fast Page & Post Duplicator
≤6.3Update to 6.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
Media Library Assistant
≤3.33Update to 3.34
- Medium4.9Authenticated (Administrator+) SQL Injection via 'type' Parameter
Apocalypse Meow
≤22.1.0Update to 23.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls
OoohBoi Steroids for Elementor
≤2.1.24Update to 2.1.25
- Medium6.5Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
Fluent Forms Pro Add On Pack
≤6.1.17Update to 6.1.18
- High7.2Unauthenticated Stored Cross-Site Scripting via Draft Form Submission
Fluent Forms Pro Add On Pack
≤6.1.17Update to 6.1.18
- Medium5.3Unauthenticated Information Exposure
WP Booking System – Booking Calendar
≤2.0.19.12Update to 2.0.19.13
- High8.1Unauthenticated Local File Inclusion
Etchy - Print Shop WordPress Theme
≤1.0No patch available
- High8.1Unauthenticated PHP Object Injection
Mounthood | Ski and Snowboarding HTML Template
≤1.3.2No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
Dental Clinic
≤3.7No patch available
- High8.1Unauthenticated PHP Object Injection
Secudeal Payments for Ecommerce
≤1.1No patch available
- High8.1Unauthenticated PHP Object Injection
Estate
≤1.3.4No patch available
- Critical9.1Unauthenticated Arbitrary File Download
ionCube Tester Plus
≤1.3Update to 1.4
- Medium5.3Missing Authorization
Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress
≤2.4.0Update to 2.5.0
- High8.8Authenticated (Employee+) Privilege Escalation
Booking for Appointments and Events Calendar – Amelia
≤1.2.38Update to 2.0
- High8.1Unauthenticated Local File Inclusion
CasaMia | Property Rental Real Estate WordPress Theme
≤1.1.2No patch available
- High8.1Unauthenticated PHP Object Injection
Equestrian Centre - Horse-riding School Theme
≤1.5No patch available