Database
WordPress Vulnerability Database (page 343)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) SQL Injection
JS Help Desk – AI-Powered Support & Ticketing System
≤3.0.1Update to 3.0.2
- High8.1Unauthenticated Local File Inclusion
Zota - Elementor Multi-Purpose WooCommerce Theme
≤1.3.14Update to 1.3.15
- Medium4.3Authenticated (Author+) Insecure Direct Object Reference
Image Photo Gallery Final Tiles Grid
≤3.6.11Update to 3.6.12
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported)
≤1.4.8No patch available
- Medium5.3Missing Authorization
Travel Agency
≤1.5.5Update to 1.5.6
- High8.1Unauthenticated Local File Inclusion
Gable - Structure & Building Franework WordPress Theme
≤1.5No patch available
- High8.1Unauthenticated PHP Object Injection
Prestige
<1.4.1Update to 1.4.1
- High7.5Authenticated (Contributor+) Local File Inclusion
Biolife - Organic Food WordPress Theme ( RTL Supported )
≤3.2.3No patch available
- Medium5.3Missing Authorization
Education Base
≤3.0.8Update to 4.0.0
- Medium5.3Missing Authorization
Perfect Portfolio
≤1.2.4Update to 1.2.5
- High8.1Unauthenticated Local File Inclusion
PJ | Life & Business Coaching Site Template
≤3.0.0No patch available
- High8.1Unauthenticated Local File Inclusion
FiveStar - Hotel Booking WordPress Theme
≤1.7No patch available
- Medium6.1Reflected Cross-Site Scripting
Mollie Payments for WooCommerce
≤8.1.1Update to 8.1.2
- Medium5.3Unauthenticated Payment Bypass
Delivery Date Time & Pickup for WooCommerce
≤2.5.5Update to 2.5.6
- High8.1Unauthenticated PHP Object Injection
Extreme Store
≤1.5.7No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Yoast Duplicate Post
≤3.2.3Update to 3.2.4
- High8.1Unauthenticated Local File Inclusion
Yokoo
≤1.1.11No patch available
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported )
≤3.0.3No patch available
- High7.5Authenticated (Contributor+) PHP Object Injection
Modal Popup Box — Popup Maker & Popup Builder
≤1.6.1Update to 1.6.2
- High8.1Unauthenticated PHP Object Injection
Lorem Ipsum
≤1.2.6No patch available
- Medium5.3Missing Authorization
MAS Videos
≤1.3.2Update to 1.3.3
- High8.8Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover
Videospirecore Theme Plugin
≤1.0.6No patch available
- Medium5.3Unauthenticated Protected Post Exposure via ajax_post_grid_load_more
WPZOOM Addons for Elementor – Starter Templates & Widgets
≤1.3.2Update to 1.3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute
BuddyHolis ListSearch
≤1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
IDE Micro code-editor
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute
WDES Responsive Popup
≤1.3.6No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Information Exposure
Invoct – PDF Invoices & Billing for WooCommerce
≤1.6Update to 1.7
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
MMA Call Tracking
≤2.3.15No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter
WPlyr Media Block
≤1.3.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute
Slideshow Wp
≤1.1No patch available