Database
WordPress Vulnerability Database (page 326)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Admin+) Remote Code Execution
Advanced Woo Labels – Product Labels & Badges for WooCommerce
≤2.36Update to 2.37
- High8.1Unauthenticated Local File Inclusion
The Issue - Versatile Magazine WordPress Theme
≤1.6.11Update to 1.6.12
- Medium4.3Missing Authorization
Pochipp
<1.18.9Update to 1.18.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Bakery Autoresponder Addon
≤1.0.6No patch available
- Medium5.3Missing Authorization
Bakery Autoresponder Addon
≤1.0.6No patch available
- High8.1Unauthenticated Local File Inclusion
Evently - Conference & Meetup WordPress Theme
≤1.7No patch available
- High8.1Unauthenticated Local File Inclusion
CloudMe | Cloud Storage & File-Sharing WordPress Theme
≤1.2.2No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WooCommerce Coming Soon Product with Countdown
≤5.0No patch available
- High8.1Multipurpose Landing Page WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion
Innovio - Multipurpose Landing Page WordPress Theme
≤1.9Update to 1.9.1
- High8.1Unauthenticated Local File Inclusion
Great Lotus | Buddhist Temple WordPress Theme + RTL
≤1.3.1No patch available
- High8.1Unauthenticated Local File Inclusion
Alchemists - Sports, eSports & Gaming Club and News WordPress Theme
≤4.6.0No patch available
- High8.1Unauthenticated Local File Inclusion
Aviana - Elegant Wellness & Spa WordPress Theme
≤2.1Update to 2.3.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
FSM Custom Featured Image Caption
≤1.25.1No patch available
- High8.1Kids Store and Baby Shop WordPress Theme <= 2.0 - Unauthenticated Local File Inclusion
Cocco - Kids Store and Baby Shop WordPress Theme
≤2.0Update to 2.0.1
- High8.1Unauthenticated Local File Inclusion
FixTeam | Electronics & Mobile Devices Repair WordPress Theme
≤1.4No patch available
- High8.1Unauthenticated Local File Inclusion
Helvig - Creative Portfolio WordPress Theme
≤1.0No patch available
- Medium5.3Missing Authorization
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
≤2.1.18Update to 2.2.1
- High8.1Unauthenticated Local File Inclusion
tribe
≤1.7.3No patch available
- Medium4.3Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter
Post Duplicator
≤3.0.8Update to 3.0.9
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
WP Recipe Maker
≤10.6.0Update to 10.6.1
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
Disable Admin Notices – Hide Dashboard Notifications
≤1.4.2Update to 1.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
Secure Copy Content Protection and Content Locking
≤5.0.1Update to 5.0.2
- Medium5.0Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload
Responsive Lightbox & Gallery
≤2.7.1Update to 2.7.2
- High8.8Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter
Advanced Woo Labels – Product Labels & Badges for WooCommerce
≤2.36Update to 2.37
- High7.5Unauthenticated SQL Injection via 'sort' Parameter
Geo Mashup
≤1.13.17Update to 1.13.18
- High7.5Missing Authorization to Unauthenticated Arbitrary Post Creation and Deletion via Forged Base64 Token
WPGSI: Spreadsheet Integration
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Site Identity Block Attributes
Rise Blocks – A Complete Gutenberg Page Builder
≤3.7No patch available
- Medium6.1Clean, Minimal Elementor WooCommerce <= 2.2.7 - Reflected Cross-Site Scripting
Claue - Clean, Minimal Elementor WooCommerce Them
≤2.2.7No patch available
- Medium5.3Missing Authorization
WooCommerce Order Details
≤3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
tagDiv Composer
≤5.4.4Update to 5.4.5