Database
WordPress Vulnerability Database (page 325)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
≤1.9.5Update to 1.9.6
- High8.1Florist and Flower Shop WordPress Theme <= 1.0 - Unauthenticated Local File Inclusion
Fiorello - Florist and Flower Shop WordPress Theme
≤1.0No patch available
- High7.2Authenticated (Editor+) Arbitrary File Upload
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.3.2Update to 3.3.3
- High8.1Unauthenticated Local File Inclusion
horizon
≤1.1No patch available
- Medium4.3Missing Authorization
PDF Poster – Let visitors read PDF’s without leaving the page
≤2.4.0Update to 2.4.1
- High8.1eCommerce HTML5 Template <= 1.5.16 - Unauthenticated Local File Inclusion
Molla - eCommerce HTML5 Template
≤1.5.16Update to 1.5.17
- Medium4.3Authenticated (Subscriber+) Directory Traversal
Squeeze – Browser-Based Image Compression & WebP Converter (No API, No Limits)
≤1.7.7Update to 1.7.8
- High8.1Unauthenticated Local File Inclusion
ElectroServ | Electrical Repair Service WordPress Theme
≤1.3.2No patch available
- High8.1Unauthenticated Local File Inclusion
Shaha | Islamic Centre & Mosque Theme + RTL
≤1.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Starto | Software AI Startup WordPress
<2.2.5Update to 2.2.5
- High8.1Unauthenticated Local File Inclusion
Playa | Beach & Pool Club WordPress Theme
≤1.3.9No patch available
- Medium5.3Missing Authorization
WeDesignTech Ultimate Booking Addon
≤1.0.3Update to 1.0.4
- High8.1Creative WordPress Theme for Agencies and Freelancers <= 1.3 - Unauthenticated Local File Inclusion
Overton - Creative WordPress Theme for Agencies and Freelancers
≤1.3No patch available
- High8.1Unauthenticated Local File Inclusion
Malgré - Creative Agency WordPress Theme
≤1.0.3No patch available
- Medium5.3Missing Authorization
Permalink Manager Lite
<2.5.3Update to 2.5.3
- High8.1Unauthenticated Local File Inclusion
apollo
≤1.3.1No patch available
- High8.1Unauthenticated Local File Inclusion
Chronicle
≤1.0No patch available
- High8.1Unauthenticated Local File Inclusion
Honor | Shooting Club & Weapon and Gun Store Theme
≤2.3No patch available
- High8.1Lawyer WordPress Theme <= 1.2 - Unauthenticated Local File Inclusion
Justicia - Lawyer WordPress Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
Marra - Beauty WordPress Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
fleur
≤2.0No patch available
- High8.1Unauthenticated Local File Inclusion
quantum
≤1.0No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
PowerPress Podcasting plugin by Blubrry
≤11.15.10Update to 11.15.11
- High8.1Delightful Cake Shop Theme <= 1.2 - Unauthenticated Local File Inclusion
Sweet Jane - Delightful Cake Shop Theme
≤1.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
photography
≤7.6.1No patch available
- High8.1Unauthenticated Local File Inclusion
SetSail - Travel Agency WordPress Theme
≤1.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Portfolio Awa
≤1.4.4No patch available
- High8.1Unauthenticated Local File Inclusion
Zentrum - Property & Apartment Showcase WordPress Theme
≤1.0No patch available
- Medium5.3Missing Authorization
Scientific and Interactive Blocks – inseri core
≤1.0.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Architecturer WordPress for Interior Designer
<3.9.5Update to 3.9.5