Database
WordPress Vulnerability Database (page 315)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
DeepDigital – Web Design Agency WordPress Theme
≤1.0.2No patch available
- High8.1Unauthenticated PHP Object Injection
Jardi | Winery, Vineyard & Wine Shop WordPress Theme
≤1.7.2No patch available
- Critical9.8Unauthenticated PHP Object Injection via 'download_csv'
Database for Contact Form 7, WPforms, Elementor forms
≤1.4.7Update to 1.4.8
- Medium4.3Missing Authorization
E2Pdf – Export Pdf Tool for WordPress
≤1.28.15Update to 1.32.00
- High8.1Unauthenticated Local File Inclusion
AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme
≤1.2.5No patch available
- High8.1Business Directory WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion
FindAll - Business Directory WordPress Theme
≤1.4No patch available
- High8.1Unauthenticated Privilege Escalation via 'rcp_level'
Membership Plugin – Kadence Memberships
≤3.2.20Update to 3.2.21
- Critical9.8Babysitting & Nanny Theme <= 1.2.2 - Unauthenticated PHP Object Injection
Au Pair Agency - Babysitting & Nanny Theme
≤1.2.2No patch available
- High8.1Unauthenticated Local File Inclusion
Felizia | Fertility Center & Medical WordPress Theme
≤1.3.4No patch available
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation
≤1.4.24Update to 1.4.25
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
My Calendar – Accessible Event Manager
≤3.7.3Update to 3.7.4
- Medium4.3Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor
Seraphinite Accelerator
≤2.28.14Update to 2.28.15
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Log Clearing
Seraphinite Accelerator
≤2.28.14Update to 2.28.15
- Medium6.5Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema()
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
≤1.6.0Update to 1.6.1
- High7.5Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie
JS Help Desk – AI-Powered Support & Ticketing System
≤2.8.2Update to 2.8.3
- Medium6.1Reflected Cross-Site Scripting via 'vi' Parameter
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.7.1Update to 4.7.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.12.3Update to 1.12.4
- Medium6.5Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
WP-Members Membership Plugin
≤3.5.5.1Update to 3.5.6
- Medium5.4Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace
Enable Media Replace
≤4.1.7Update to 4.1.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field
morkva UA Shipping – Nova Poshta, Ukrposhta, Rozetka, Nova Global
≤1.7.9Update to 1.7.10
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤5.0.3Update to 5.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters
WPBookit
≤1.0.8Update to 1.0.9
- Medium5.3Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
WPBookit
≤1.0.8Update to 1.0.9
- Medium6.5Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.9.16Update to 5.9.17
- High7.2Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints
Post Grid Gutenberg Blocks – PostX
≤5.0.8Update to 5.0.9
- High8.1Unauthenticated PHP Object Injection
Grand Wedding WordPress
<3.1.11Update to 3.1.11
- Medium6.1Reflected Cross-Site Scripting
BuddyApp - Mobile First Community WordPress theme
≤1.9.2No patch available
- High8.1Unauthenticated PHP Object Injection
Pets Club - Pet Care WordPress Theme + Shop
≤2.3No patch available
- Medium6.1Reflected Cross-Site Scripting
TheBi - Photography WordPress Theme
≤1.0.5No patch available
- High8.1Pizza and Fast Food WordPress Theme <= 1.3 - Unauthenticated Local File Inclusion
Don Peppe - Pizza and Fast Food WordPress Theme
≤1.3No patch available