Database
WordPress Vulnerability Database (page 335)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Popup Box – Easily Create WordPress Popups
≤3.2.12Update to 3.2.13
- Medium5.3Unauthenticated Private Post Disclosure
Context Blog
≤1.2.5Update to 1.2.6
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification
Frontend User Notes
≤2.1.0Update to 2.1.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Order Splitter for WooCommerce
≤5.3.5Update to 5.3.6
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP 404 Auto Redirect to Similar Post
≤1.0.5Update to 1.0.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification
EmailKit – Email Customizer for WooCommerce & WP
≤1.6.2Update to 1.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Filestack
≤2.0.8No patch available
- Medium4.7Unauthenticated Open Redirect via 'redirect_to' Parameter
URL Shortify – Simple and Easy URL Shortener
≤1.12.1Update to 1.12.2
- Medium6.1Unauthenticated Open Redirect via 'requested_page' Parameter
Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms
1.0.0 – 1.2.7Update to 1.2.8
- High8.6Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤3.3.2Update to 3.3.3
- High7.5Unauthenticated SQL Injection via payment Parameter
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.21Update to 6.4.22
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter
Display During Conditional Shortcode
≤1.2Update to 1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter
Rent Fetch
≤0.32.6Update to 0.32.7
- High8.1Unauthenticated Local File Inclusion
Coworking - Open Office & Creative Space WordPress Theme
≤1.6.1No patch available
- Medium4.3Missing Authorization
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.5.3Update to 3.5.4
- High8.1Unauthenticated Local File Inclusion
Parkivia | Auto Parking & Car Maintenance WordPress Theme
≤1.1.9No patch available
- High7.5Shortcodes <= 3.7 - Authenticated (Contributor+) PHP Object Injection
Applay - Shortcodes
≤3.7No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection via 'raw'
Bookster – Appointment Booking Management System
≤2.1.1Update to 2.2.0
- Medium5.3Missing Authorization
Panda Pods Repeater Field
≤1.5.12Update to 1.5.13
- High8.8Authenticated (Author+) PHP Object Injection via Live Composer Compatibility
Advanced AJAX Product Filters
≤3.1.9.6Update to 3.1.9.7
- High8.1Unauthenticated Local File Inclusion
Blabber | Elementor Blog & News Magazine Theme
≤1.7.0No patch available
- High8.1Unauthenticated Local File Inclusion
Fooddy 24/7 - Food Delivery Takeout WordPress Theme + Elementor + RTL
≤1.3.10No patch available
- High8.1Unauthenticated Local File Inclusion
A-Mart - Organic Products Store Shopify Theme
≤1.0.2No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Wiguard – CCTV & Security WordPress Theme for Surveillance Companies
<2.0.1Update to 2.0.1
- Medium5.3Missing Authorization
Frontend File Manager Plugin
≤23.5No patch available
- High8.1Unauthenticated Local File Inclusion
SevenTrees | Real Estate Property WordPress Theme
≤1.0.2No patch available
- Medium5.3Unauthenticated Global Content Protection Bypass
Passster – Password Protect Pages and Content
≤4.2.25Update to 4.2.26
- High8.1Unauthenticated Local File Inclusion
Rhodos - Business Portfolio Elementor Blocks & Template Kit
≤1.3.3No patch available
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification
Booking Calendar
≤10.14.14Update to 10.14.15
- High8.1Unauthenticated Local File Inclusion
Soleng | Solar Energy WordPress Theme
≤1.0.5No patch available