Database
WordPress Vulnerability Database (page 322)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Local File Inclusion
Peter Mason | Custom Tailoring and Clothing Store WordPress Theme
≤1.4.5No patch available
- High8.1Unauthenticated Local File Inclusion
Happy Baby | Nanny & Babysitting Services Children WordPress Theme
≤1.2.12No patch available
- Medium4.9Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter
MailArchiver
≤4.5.0Update to 4.5.1
- Medium5.3Missing Authorization to Unauthenticated Paidy Order Manipulation
Japanized for WooCommerce
≤2.8.4Update to 2.8.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute
Electric Enquiries
≤1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute
WP Accessibility
≤2.3.1Update to 2.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
Simple Download Monitor
≤4.0.5Update to 4.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link
Xpro Addons — 150+ Widgets for Elementor
≤1.4.24Update to 1.4.25
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fields
Automotive Car Dealership Business WordPress Theme
≤13.4Update to 13.4.2
- Critical9.8Unauthenticated Privilege Escalation
Listee
≤1.1.6Update to 1.1.7
- Medium5.3Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter
WP Recipe Maker
≤10.3.2Update to 10.3.3
- High7.5Missing Authorization to Unauthenticated Payment Status modification
Fluent Forms Pro Add On Pack
≤6.1.17Update to 6.1.18
- High8.8Authenticated (Author+) Arbitrary File Upload
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.2.8Update to 4.2.9
- Medium6.1Reflected Cross-Site Scripting
ListingPro Plugin
≤2.9.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WhatsApp Chat - WordPress WhatsApp Chat
≤1.2.0No patch available
- Medium6.1AllInOne - Banner with Thumbnails <= 3.8 - Reflected Cross-Site Scripting
LambertGroup - AllInOne - Banner with Thumbnails
≤3.8No patch available
- High8.1Unauthenticated Local File Inclusion
Little Birdies | Multipurpose Children PSD Template
≤1.3.16No patch available
- Medium6.1Banner Rotator <= 3.8 - Reflected Cross-Site Scripting
AllInOne - Banner Rotator
≤3.8No patch available
- Medium6.1Health Medical Clinic WordPress Theme <= 14.9 - Reflected Cross-Site Scripting
MediCenter - Health Medical Clinic WordPress Theme
≤14.9No patch available
- Medium6.5Malicious .htaccess directive
OVRI Payment
1.7.0 – 1.7.0No patch available
- Medium4.3Cross-Site Request Forgery
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.6.6Update to 7.6.7
- Medium6.1Responsive WordPress Theme <= 4.14.0 - Reflected Cross-Site Scripting
uDesign - Responsive WordPress Theme
≤4.14.0No patch available
- Medium6.1AllInOne - Content Slider <= 3.8 - Reflected Cross-Site Scripting
LambertGroup - AllInOne - Content Slider
≤3.8No patch available
- High8.8Authenticated (Contributor+) Arbitrary File Uploads
Filr – Secure document library
≤1.2.13Update to 1.2.14
- High8.1Unauthenticated PHP Object Injection
Good Energy - Ecology & Renewable Energy WordPress Theme
≤1.7.7No patch available
- Medium4.3Missing Authorization
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
≤1.8.3Update to 1.8.4
- Medium5.3Missing Authorization
Post Timeline
≤2.4.1Update to 2.4.2
- High8.1Unauthenticated Local File Inclusion
SmartSEO | SEO & Marketing HTML Theme
≤2.9No patch available
- High7.2Unauthenticated Sever-Side Request Forgery
Podigee for WordPress: Podcast Episodes to Blog Posts
≤1.4.0Update to 1.4.1
- Medium6.1AllInOne - Banner with Playlist <= 3.8 - Reflected Cross-Site Scripting
LambertGroup - AllInOne - Banner with Playlist
≤3.8No patch available