Database
WordPress Vulnerability Database (page 324)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
WP Social Meta
≤1.0.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Setting
Custom Logo
≤2.2No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'customer_name'
EM Cost Calculator
≤2.3.1No patch available
- Medium5.4Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API
The Events Calendar
≤6.15.16Update to 6.15.16.1
- High8.1NonProfit & Ecology Theme <= 1.0.0 - Unauthenticated Local File Inclusion
Ekoterra - NonProfit & Ecology Theme
≤1.0.0No patch available
- High8.1Unauthenticated Local File Inclusion
Buzz Stone | Magazine & Viral Blog WordPress Theme
≤1.0.2No patch available
- High8.1Dentist & Dental Clinic WordPress Theme <= 1.16 - Unauthenticated Local File Inclusion
Tooth Fairy - Dentist & Dental Clinic WordPress Theme
≤1.16No patch available
- High8.1Unauthenticated Local File Inclusion
wabi-sabi
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
Green Planet | Environmental Non-Profit WordPress Theme
≤1.1.14No patch available
- High8.1Unauthenticated Local File Inclusion
Eona - Fashion WordPress Theme
≤1.3No patch available
- High8.1Unauthenticated Local File Inclusion
Cortex - Agency WordPress Theme
≤1.9Update to 2.0
- Medium4.3Missing Authorization
DEPART – Deposit and Part payment for Woo
≤1.0.7Update to 1.0.8
- High8.1Multipurpose Store WooCommerce WordPress Shop Theme <= 1.2 - Unauthenticated Local File Inclusion
Woopy - Multipurpose Store WooCommerce WordPress Shop Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
Consultor | A Business Financial Advisor PSD Template
≤1.2.4No patch available
- High8.1Fitness and Gym WordPress <= 1.9 - Unauthenticated Local File Inclusion
TopFit - Fitness and Gym WordPress Theme
≤1.9No patch available
- High8.1Unauthenticated Local File Inclusion
Crown Art | Drawing and Music School WordPress Theme
≤1.2.11No patch available
- High7.5Unauthenticated SQL Injection
Riode Core
≤1.6.26Update to 1.6.27
- High8.1Digital Agency WordPress Theme <= 1.7 - Unauthenticated Local File Inclusion
Holmes - Digital Agency WordPress Theme
≤1.7No patch available
- Medium4.3Missing Authorization
Tutor LMS – eLearning and online course solution
≤3.9.5Update to 3.9.6
- High8.1Unauthenticated Local File Inclusion
The Mounty | Hiking Campground & Children Camping WordPress Theme
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
grandnews
≤3.4.3No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Theater for WordPress
≤0.19Update to 0.19.1
- Medium5.3Missing Authorization
Responsive Posts Carousel WordPress Plugin
≤15.1No patch available
- High8.1Unauthenticated Local File Inclusion
Wolmart | Multi-Vendor Marketplace WooCommerce Theme
≤1.9.6No patch available
- High8.1Sports WordPress <= 1.2 - Unauthenticated Local File Inclusion
TopScorer - Sports WordPress Theme
≤1.2No patch available
- High8.1Pastry and Cake Shop WordPress Theme <= 1.6 - Unauthenticated Local File Inclusion
Dolcino - Pastry and Cake Shop WordPress Theme
≤1.6No patch available
- High8.1Organic Tea Shop WordPress Theme <= 1.6 - Unauthenticated Local File Inclusion
Verdure - Organic Tea Shop WordPress Theme
≤1.6No patch available
- High8.8Authenticated (Contributor+) Remote Code Execution
Builderall for WordPress
≤3.0.1No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Gift Up Gift Cards for WordPress and WooCommerce
≤3.1.7Update to 3.1.8
- High8.1Unauthenticated Local File Inclusion
GoTravel - Travel Agency WordPress Theme
≤2.1No patch available