Database
WordPress Vulnerability Database (page 316)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Local File Inclusion
Askka - Candle Shop WordPress Theme
≤1.0No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Podlove Web Player
≤5.9.1Update to 5.9.2
- Medium6.1Reflected Cross-Site Scripting
Thebe - Portfolio WordPress Theme
≤1.3.0No patch available
- High8.1Unauthenticated Local File Inclusion
Remons - Car Rental Elementor Template Kit
≤1.3.4Update to 1.3.5
- High8.1Unauthenticated Local File Inclusion
Hoverex | Cryptocurrency & ICO Elementor Template Kit
≤1.5.10No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Keenarch - Building & Construction WordPress Theme
<2.0.1Update to 2.0.1
- High8.1Unauthenticated Local File Inclusion
Berger - WordPress Creative Agency Portfolio Theme
≤1.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Thecs - Portfolio WordPress Theme
≤1.4.7No patch available
- Medium5.3Missing Authorization
WP CTA – Call Now Button, Sticky Button & Call to Action Builder
≤2.1.2Update to 2.1.3
- Critical9.1Unauthenticated Arbitrary File Deletion
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
≤1.4.2No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
CarZone - A Complete Car Dealer HTML Wire-Frame
≤3.7No patch available
- Medium5.3Authenticated (Subscriber+) Arbitrary File Upload
Lendiz - Loan & Funding Agency WordPress Theme
<2.0.1Update to 2.0.1
- High8.1Unauthenticated Local File Inclusion
wpDataTables (Premium)
≤6.5.0.1Update to 6.5.0.2
- High7.5Authenticated (Subscriber+) Local File Inclusion
Cookiteer
≤1.4.8No patch available
- High8.1Travel Blog <= 1.5 - Unauthenticated Local File Inclusion
Wanderland - Travel Blog
≤1.5No patch available
- High8.1Unauthenticated PHP Object Injection
Handyman - Home Services Booking App, Website & Admin Panel
≤1.4No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Charety - Charity & Donation WordPress Theme
<2.0.2Update to 2.0.2
- Medium6.1Reflected Cross-Site Scripting
Agrofood - Elementor WooCommerce WordPress Theme
<1.4.0Update to 1.4.0
- High8.1Fitness and Gym WordPress Theme <= 1.8.1 - Unauthenticated Local File Inclusion
Prowess - Fitness and Gym WordPress Theme
≤1.8.1No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Nutrie - Health Coach and Nutrition WordPress Theme
<2.0.1Update to 2.0.1
- High8.1Unauthenticated PHP Object Injection
Classter | Multi-Purpose HTML Theme
≤2.5No patch available
- High8.1Unauthenticated PHP Object Injection
Solaris
≤2.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
≤1.1.5Update to 1.1.6
- Critical9.8Unauthenticated Privilege Escalation via Membership Registration
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.2Update to 5.1.3
- High8.8Authenticated (Contributor+) Local File Inclusion
Page Builder by SiteOrigin
≤2.33.5Update to 2.34.0
- Critical9.8Authentication Bypass
All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login
≤2.2.5Update to 2.2.6
- High7.2Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.0.0.3Update to 7.1.0
- Medium6.5Authenticated (Administrator+) SQL Injection via JSON Import
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.2.7Update to 5.2.8
- Medium5.3Missing Authorization to Unauthenticated API Key Modification
AI ChatBot with ChatGPT and Content Generator by AYS
≤2.7.5Update to 2.7.6
- High8.8Authenticated (Agent+) Privilege Escalation
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.2.7Update to 5.2.8