Database
WordPress Vulnerability Database (page 336)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Local File Inclusion
Impacto Patronus | Nature Protection, Petitions & Social Activism WordPress Theme + RTL
≤1.2.3No patch available
- High7.5Unauthenticated SQL Injection
Wolmart Core
≤1.9.6Update to 1.9.7
- High8.1Unauthenticated Local File Inclusion
Zio Alberto – Restaurant – Cafe – Bistro Theme
≤1.2.2No patch available
- Medium5.3Unauthenticated Protected Content Disclosure
Passster – Password Protect Pages and Content
≤4.2.23Update to 4.2.24
- High8.1Unauthenticated Local File Inclusion
Ironfit - Fitness, Gym and Crossfit WordPress Theme
≤1.5No patch available
- High8.1Pet Shop and Veterinary WordPress <= 1.3 - Unauthenticated Local File Inclusion
PawFriends - Pet Shop and Veterinary WordPress Theme
≤1.3No patch available
- Low3.7Unauthenticated Sensitive Information Exposure via PHP Type Juggling
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
≤1.4.14Update to 1.4.15
- High8.1Unauthenticated Local File Inclusion
Netmix | Broadband & Telecom Internet Provider WordPress Theme
≤1.0.10No patch available
- Medium4.3Pet Shop and Veterinary WordPress <= 1.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
PawFriends - Pet Shop and Veterinary WordPress Theme
≤1.3No patch available
- Medium5.3Unauthenticated Information Exposure
Simple Ajax Chat – Add a Fast, Secure Chat Box
≤20251121Update to 20260217
- High8.1Unauthenticated Local File Inclusion
Saveo | In-home Care & Private Nursing Agency WordPress Theme
≤1.1.2No patch available
- Medium5.3Missing Authorization
WP Compress – Instant Performance & Speed Optimization
≤6.60.28Update to 6.60.29
- Medium6.1Reflected Cross-Site Scripting via Filter Parameters
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.11.1Update to 2.11.2
- High8.1Unauthenticated Local File Inclusion
Gustavo | Mexican Grill, Bar & Restaurant WordPress Theme
≤1.2.2No patch available
- High8.1Unauthenticated Local File Inclusion
Photolia | Photo Company & Supply Store WordPress Theme
≤1.0.3No patch available
- High8.1Unauthenticated Local File Inclusion
UnlimHost - Web Hosting & Internet Technology WordPress Theme
≤1.2.3No patch available
- High8.1Unauthenticated Local File Inclusion
Jude | Nail Bar & Beauty Salon WordPress Theme
≤1.3.0No patch available
- Medium4.3Cross-Site Request Forgery
Court Reservation – Tennis, Padel & Sports Court Booking
<1.10.9Update to 1.10.9
- Medium6.5Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling
Brevo – Email, SMS, Web Push, Chat, and more.
≤3.3.0Update to 3.3.1
- High8.1Unauthenticated Local File Inclusion
Isida - Plastic Surgery Clinic Medical WordPress Theme
≤1.4.2No patch available
- High8.1Unauthenticated Local File Inclusion
redy
≤1.0.2No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection via File Name
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤7.37Update to 7.38
- High8.1Unauthenticated Local File Inclusion
Marveland - Theme Park & Festival WordPress Theme
≤1.3.0No patch available
- High7.2Reflected Cross-Site Scripting via 'template' Parameter
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content
≤5.0.10Update to 5.0.11
- Medium5.3Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint
EventPrime – Events Calendar, Bookings, Tickets & AI
≤4.2.8.4Update to 4.2.8.5
- High7.7Improper Access Control to Payment Status Update
افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce)
≤5.0.16Update to 5.0.17
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.50.2Update to 1.50.3
- High8.8Authenticated (Subscriber+) Limited Local File Inclusion
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.8.6Update to 4.8.7
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
WowRevenue – Product Bundles & Bulk Discounts
≤2.1.3Update to 2.1.4
- Medium6.5Authenticated (Contributor+) SQL Injection
Collapsing Archives
≤3.0.7Update to 3.0.8