Database
WordPress Vulnerability Database (page 337)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
Ippsum - Business Consulting WordPress Theme
≤1.2.0Update to 1.2.1
- Medium5.3Missing Authorization
Razorpay for WooCommerce
≤4.8.3Update to 4.8.4
- High8.1Unauthenticated Local File Inclusion
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
≤6.7.0Update to 6.7.1
- Medium4.3Missing Authorization
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.4.4.1Update to 5.4.4.2
- Medium4.3Missing Authorization
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<6.0.7.2Update to 6.0.7.2
- High7.2Authenticated (Admin+) Remote Code Execution
Modal Dialog
≤3.5.16Update to 3.5.17
- Medium6.5Authenticated (Contributor+) SQL Injection
Geo to Lat
≤1.0.19Update to 1.1
- Medium5.3Missing Authorization
leadlovers forms
≤1.0.2No patch available
- Medium6.5Authenticated (Subscriber+) Arbitrary File Download
Open User Map – Interactive Leaflet Maps
≤1.4.16Update to 1.4.17
- High7.5Authenticated (Contributor+) Local File Inclusion
Medilink-Core
<2.0.7Update to 2.0.7
- Medium5.3Missing Authorization
Support for CitiLights - Real Estate WordPress Theme
<3.7.2Update to 3.7.2
- Medium6.1Reflected Cross-Site Scripting
Link Whisper Free
≤0.9.2Update to 0.9.3
- High7.5Authenticated (Contributor+) PHP Object Injection
Banner Management For WooCommerce
≤2.5.1No patch available
- High7.5Authenticated (Contributor+) Local File Inclusion
Turbo Manager
<4.0.8Update to 4.0.8
- Medium6.5Authenticated (Contributor+) SQL Injection
Collapsing Categories
≤3.0.9Update to 3.0.12
- Medium5.3Missing Authorization
iGMS Direct Booking
≤1.3Update to 2.0
- Medium5.3Missing Authorization
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.2.1Update to 2.2.2
- Medium5.3Missing Authorization
WPLifeCycle – Free PHP Version Info & Website Manager
≤3.3.1Update to 4.0
- Medium4.3Missing Authorization
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤3.1.11Update to 3.1.13
- Medium6.4Authenticated (Hydra host+) Stored Cross-Site Scripting
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.1.38Update to 1.1.39
- Medium5.3Missing Authorization
Cream Blog
≤2.1.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Editorial Calendar
≤3.9.0Update to 3.9.1
- Medium4.3Missing Authorization
Video Conferencing with Zoom
≤4.6.6Update to 4.6.7
- Medium5.3Missing Authorization
Royale News
≤2.2.4No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤3.1.11Update to 3.1.13
- High7.2Unauthenticated Server-Side Request Forgery
GlobalPayments Gateway Provider for WooCommerce
≤1.18.3Update to 1.18.4
- Medium5.3Missing Authorization
WP Sessions Time Monitoring Full Automatic
≤1.1.3Update to 1.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Leaflet Map
≤3.4.4Update to 3.4.5
- High7.2Unauthenticated Server-Side Request Forgery
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.11Update to 5.12
- Medium4.3Missing Authorization
TotalPoll for Polls and Contests
≤4.12.0No patch available