Database
WordPress Vulnerability Database (page 44)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Tailored Tools
≤3.0.3Update to 3.0.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Interactive Content – H5P
≤1.17.9Update to 1.17.10
- Medium4.3Missing Authorization
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2
- High8.1Unauthenticated PHP Object Injection
Save Life | Non-Profit, Charity & Donations WordPress Theme
≤1.2.14No patch available
- Medium6.50.9.2.7 - Unauthenticated Arbitrary Shortcode Execution
Advanced Custom Fields: Extended
0.9.2.4 – 0.9.2.7Update to 0.9.2.8
- Medium5.3Missing Authorization
Front End Users
≤3.2.35No patch available
- Medium4.3Missing Authorization
News Kit Addons For Elementor
≤1.4.8Update to 1.4.9
- High7.5Unauthenticated Denial of Service
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<7.0Update to 7.0
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
<6.0.0Update to 6.0.0
- High8.1Unauthenticated PHP Object Injection
Participants Database
≤2.7.8.5No patch available
- High7.5Unauthenticated SQL Injection
Participants Database
≤2.7.8.5No patch available
- High8.1Jewelry & Watch Store Shopify Theme <= 1.0.8 - Unauthenticated PHP Object Injection
Reprizo - Jewelry & Watch Store Shopify Theme
≤1.0.8No patch available
- High8.1Travel Blog Elementor Template Kit <= 1.3.10 - Unauthenticated PHP Object Injection
Vagabonds - Travel Blog Elementor Template Kit
≤1.3.10No patch available
- High8.1Unauthenticated PHP Object Injection
redy
≤1.3.5No patch available
- High8.1Unauthenticated PHP Object Injection
Holistic Center | Wellness & Spa Salon PSD Template
≤1.2.6No patch available
- High8.1Unauthenticated PHP Object Injection
Helion | Personal Portfolio & Agency WordPress Theme
≤1.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
HotLock | Locksmith & Security Systems WordPress Theme + RTL
≤1.3.9No patch available
- High8.1Responsive WordPress Theme <= 7.0 - Unauthenticated PHP Object Injection
Hostme v2 - Responsive WordPress Theme
≤7.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium6.5Authenticated (Subscriber+) SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤8.0.7Update to 8.0.8
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium5.3Missing Authorization
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
≤9.6.3.0Update to 9.6.3.1
- Medium5.3Missing Authorization
WPMobile.App – Android and iOS App Builder
≤11.86Update to 11.87
- Medium4.34.0.4 - Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
4.0.0 – 4.0.4Update to 4.0.5
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
<3.3.3Update to 3.3.3
- Medium5.3Missing Authorization
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
<34.0.1Update to 34.0.1
- Medium5.3Unauthenticated Information Exposure
Booking Package
<1.7.31Update to 1.7.31
- Medium5.34.1.20 - Missing Authorization to Unauthenticated Maintenance Mode Bypass
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
4.1.19 – 4.1.20Update to 4.1.21
- Medium4.3Missing Authorization
News Kit Addons For Elementor
≤1.4.7No patch available
- Medium4.3Missing Authorization
SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher
<5.3.5No patch available