Database
WordPress Vulnerability Database (page 341)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Auto x LINE
≤1.0.0No patch available
- Medium5.3Missing Authorization
Chocolate House
≤1.1.5Update to 1.1.6
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Getty Images
≤4.1.0No patch available
- Medium4.3Cross-Site Request Forgery
Grand Magazine | Blog WordPress
≤3.5.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Livemesh Addons by Elementor
≤9.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
Secure Copy Content Protection and Content Locking
≤4.9.8Update to 4.9.9
- High7.2Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
Customer Reviews for WooCommerce
≤5.97.0Update to 5.98.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Duka Market - Multipurpose eCommerce Template
≤1.3.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Query Blocks
≤5.5.0Update to 5.6.0
- Medium4.3Missing Authorization
Ashe
≤2.267Update to 2.268
- Medium4.3Missing Authorization
Passster – Password Protect Pages and Content
≤4.2.25Update to 4.2.26
- Critical9.8Authentication Bypass
Login with Salesforce
≤1.0.2No patch available
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Uminex - Multipurpose WooCommerce Theme
≤1.0.9No patch available
- Medium6.5Missing Authorization to Sensitive Information Exposure via Log File
Activity Log for WordPress
≤1.2.8Update to 1.2.9
- Medium4.8Unauthenticated Server-Side Request Forgery via src
Converter for Media – Optimize images | Convert WebP & AVIF
≤6.5.1Update to 6.5.2
- Medium5.3Missing Authorization to Booking Details Exposure
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.2.6Update to 5.2.7
- Critical9.8Authentication Bypass
AdForest
≤6.0.12Update to 6.0.13
- Medium4.3Cross-Site Request Forgery
SpicePress
≤2.3.2.5No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Cnvrse
<026.02.10.20Update to 026.02.10.20
- Medium4.3Missing Authorization
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.5.32Update to 3.6.0
- High8.1Unauthenticated Local File Inclusion
Tint - Renovation, Painting & Wallpapering WordPress Theme
≤1.7No patch available
- Medium4.3Cross-Site Request Forgery
Corpiva
≤1.0.96Update to 1.0.97
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Blog Filter – Post Grid Filter by Category or Tag
≤1.7.6Update to 1.7.7
- High8.1Unauthenticated Local File Inclusion
HealthFirst - Nutrition and Recipes WordPress Theme
≤1.0.1Update to 1.2.1
- High8.1Unauthenticated Local File Inclusion
Belletrist - Blog Theme for WordPress Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
FreightCo – Free Transportation & Logistics WordPress Theme
≤1.1.7No patch available
- High8.1Unauthenticated Local File Inclusion
Struktur - Creative Agency WordPress Theme
≤2.5.1No patch available
- High8.8Missing Authorization to Authenticated (Contributor+) Backup Creation and Download
FastDup – Fastest WordPress Migration & Duplicator
≤2.7.1Update to 2.7.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤2.16.8Update to 2.16.9
- High7.5Authenticated (Contributor+) PHP Object Injection
Responsive Slideshow – Photo Carousel
≤1.5.4No patch available