Database
WordPress Vulnerability Database (page 323)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
List category posts
≤0.93.1Update to 0.94.0
- High7.5Easy Stripe & Paypal donations <= 1.25 - Unauthenticated SQL Injection
WP Attractive Donations System - Easy Stripe & Paypal donations
≤1.25No patch available
- High8.1Unauthenticated Local File Inclusion
Verse - Music, Radio & Concert WordPress Theme
≤1.7.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Lawyer Directory
≤1.3.2No patch available
- Medium5.3Unauthenticated Information Exposure
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1132Update to 4.1133
- High8.1Sports Store WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion
Welldone - Sports Store WordPress Theme
≤2.4No patch available
- High8.1Unauthenticated Local File Inclusion
Muzicon - Music Festival & Concert WordPress Theme
≤1.9.0No patch available
- High8.8Authenticated (Contributor+) Remote Code Execution
JetEngine
≤3.7.2Update to 3.8.1.2
- High8.1Sound & Music WordPress Theme <= 1.14 - Unauthenticated Local File Inclusion
Midi - Sound & Music WordPress Theme
≤1.14No patch available
- Medium4.9Authenticated (Editor+) Arbitrary File Download
Directory Listings WordPress plugin – uListing
≤2.2.0No patch available
- Medium5.3Missing Authorization
Site Suggest
≤1.3.9No patch available
- High8.1Legal Advisor WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion
Notarius - Legal Advisor WordPress Theme
≤1.9No patch available
- High8.1Unauthenticated Local File Inclusion
Dr.Patterson | Medical & Healthcare Doctor WordPress Theme
≤1.3.2No patch available
- High8.1Unauthenticated Local File Inclusion
Nirvana
≤2.6No patch available
- Medium6.1Reflected Cross-Site Scripting
Responsive Zoom In/Out Slider WordPress Plugin
≤5.4.5No patch available
- Medium5.3Missing Authorization
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1052Update to 1.7.1053
- High7.2Authenticated (Shop Manager+) Arbitrary File Upload
WooCommerce License Manager
≤7.0.6Update to 7.0.7
- Medium5.3Missing Authorization
Simply Schedule Appointments
≤1.6.11.0Update to 1.6.11.1
- Medium6.5Authenticated (Author+) SQL Injection
Meow Gallery
≤5.4.4Update to 5.4.5
- High8.1Unauthenticated Local File Inclusion
Anderson | Physical Therapy & Orthopedic Clinic WordPress Theme
≤1.4.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Ultimate Learning Pro
≤3.9.1No patch available
- High8.1Wedding & Photographer WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion
Veil - Wedding & Photographer WordPress Theme
≤1.9No patch available
- Medium6.1Unauthenticated Reflected Cross-Site Scripting via 'title_tag' Parameter
WPZOOM Addons for Elementor – Starter Templates & Widgets
≤1.3.4Update to 1.3.5
- Medium6.1Reflected Cross-Site Scripting
Frontend Publishing Pro
<4.3.4Update to 4.3.4
- High8.8Authenticated (Subscriber+) Path Traversal via Backup Upload
Worry Proof Backup
≤0.2.4No patch available
- Medium5.3Insecure Direct Object Reference to Unauthenticated Limited User Deletion
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.2Update to 5.1.3
- High8.1Authentication Bypass
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.1.2Update to 5.1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea
TP2WP Importer
≤1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes
Livemesh Addons for Beaver Builder
≤3.9.2No patch available
- High7.5Unauthenticated Path Traversal to Arbitrary File Read via src
WP Responsive Images
≤1.0No patch available