Database
WordPress Vulnerability Database (page 327)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Bricks
≤2.1.4Update to 2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
EMC – Embed Calendly Scheduling With Ease
≤4.4Update to 4.5
- High8.1Unauthenticated PHP Object Injection
Celeste - Life Coach & Therapist WordPress Theme
≤1.3.6No patch available
- High8.1Home & Lifestyle Elementor WooCommerce Theme <= 1.3.15 - Unauthenticated Local File Inclusion
Aora - Home & Lifestyle Elementor WooCommerce Theme
≤1.3.15No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
≤1.2.3Update to 1.2.4
- Medium5.3Missing Authorization
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
<3.7.9Update to 3.7.9
- High8.1Unauthenticated Local File Inclusion
metro
≤2.13No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
NextScripts: Social Networks Auto-Poster
≤4.4.7Update to 4.4.8
- Medium6.1Responsive Shopify Theme - RTL support <= 1.9.8 - Reflected Cross-Site Scripting
Gecko 6.0 - Responsive Shopify Theme - RTL support
≤1.9.8No patch available
- Medium6.1Reflected Cross-Site Scripting
designthemes-portfolio
≤1.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Music WordPress
<3.4.5Update to 3.4.5
- Critical9.8Unauthenticated Arbitrary Code Execution
W3 Total Cache
≤2.9.1Update to 2.9.2
- Medium5.3Unauthenticated Information Exposure
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
≤3.5.1Update to 3.5.2
- Medium6.1Reflected Cross-Site Scripting
metro
≤2.13No patch available
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Really Simple Security Pro
≤9.5.4.0Update to 9.5.4.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
Eagle Booking
≤1.3.4.3No patch available
- High8.8Authenticated (Subscriber+) Authentication Bypass
WeDesignTech Ultimate Booking Addon
≤1.0.1No patch available
- High8.1Unauthenticated PHP Object Injection
Sweet Date
<4.0.1Update to 4.0.1
- Medium5.3Missing Authorization
eShipper Commerce
≤2.16.12Update to 2.16.13
- Medium5.3Unauthenticated Information Exposure
My Tickets – Accessible Event Ticketing
≤2.1.0Update to 2.1.1
- Medium5.3Missing Authorization
Cryptocurrency Donation Box – Bitcoin & Crypto Donations
≤2.2.13No patch available
- Medium5.3Missing Authorization
WP Frontend Profile
≤1.3.9No patch available
- Critical9.8Authentication Bypass
WeDesignTech Ultimate Booking Addon
≤1.0.1No patch available
- Medium5.3Missing Authorization
Currency Switcher for WooCommerce by WBW
≤2.2.5Update to 2.2.6
- High8.1Tennis Sports Events WordPress Theme <= 1.2.3 - Unauthenticated PHP Object Injection
Tennis SportClub - Tennis Sports Events WordPress Theme
≤1.2.3No patch available
- Medium5.3Missing Authorization
SiteGuard WP Plugin
≤1.7.9Update to 1.7.10
- Medium5.3Missing Authorization
DT Booking - WordPress Ultimate Booking Plugin
≤2.0No patch available
- High8.1Unauthenticated Local File Inclusion
Alliance | Intranet & Extranet BuddyPress WordPress Theme
≤3.1.1No patch available
- Medium4.3Authenticated (Subscriber+) Sensitive Data Exposure
Classified Listing – AI-Powered Classified ads & Business Directory
≤5.3.4Update to 5.3.5
- High8.1Unauthenticated PHP Object Injection
Kingler
≤1.7No patch available