Database
WordPress Vulnerability Database (page 45)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Creative eCommerce Multi-Purpose WordPress Theme <= 4.25.0 - Unauthenticated Stored Cross-Site Scripting
KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme
≤4.25.0No patch available
- High8.1Unauthenticated PHP Object Injection
Little Birdies | Multipurpose Children PSD Template
≤1.3.16No patch available
- High8.1Business Portfolio Elementor Blocks & Template Kit <= 1.3.3 - Unauthenticated PHP Object Injection
Rhodos - Business Portfolio Elementor Blocks & Template Kit
≤1.3.3No patch available
- High8.1Unauthenticated PHP Object Injection
Hallelujah | Religion & Church Charity WordPress Theme
≤1.1.1No patch available
- High8.1Unauthenticated Local File Inclusion
Your Dress | Dress Rental & Clothing Store WordPress Theme + Shop
≤1.4.1No patch available
- High7.2Responsive WordPress Theme <= 7.0 - Unauthenticated Stored Cross-Site Scripting
Hostme v2 - Responsive WordPress Theme
≤7.0No patch available
- High8.1Unauthenticated PHP Object Injection
ZenSoul - Spa Salon & Wellness WordPress Theme + Shop & AI
≤1.13No patch available
- Medium4.3Missing Authorization
Car Rental Manager – Online Vehicle Booking System
≤1.5.3Update to 1.5.4
- Medium4.3Missing Authorization
MAS Videos
<1.3.5Update to 1.3.5
- Medium4.3Missing Authorization
Advanced Twenty Seventeen
≤1.3.1No patch available
- Medium5.3Unauthenticated Payment Forgery
Payment Gateway for Telcell
<2.0.5Update to 2.0.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Participants Database
≤2.7.8.5No patch available
- Medium4.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.25Update to 2.9.26
- Medium5.3Missing Authorization
Bus Ticket Booking with Seat Reservation
≤5.9.7Update to 5.9.8
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.30Update to 1.0.31
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rootblox – Header & Footer Builder for Full Site Editing (FSE)
≤1.0.7Update to 1.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6
- Medium4.3Cross-Site Request Forgery
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium4.3Missing Authorization
Meta Box – A Framework for Dynamic Websites
≤5.15.2Update to 5.15.3
- Medium5.3Missing Authorization
Seriously Simple Podcasting
≤3.17.0Update to 3.17.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Seriously Simple Podcasting
≤3.17.0Update to 3.17.1
- High7.1Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.8Unauthenticated PHP Object Injection
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.5.17Update to 5.0.0
- High8.1Unauthenticated Local File Inclusion
Rootblox – Header & Footer Builder for Full Site Editing (FSE)
≤1.0.6Update to 1.0.7
- Medium5.3Missing Authorization
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.1.2Update to 3.1.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
Workreap Core
<3.4.4Update to 3.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Brizy – Page Builder
2.8.23 – 2.8.23Update to 2.8.24
- High7.2Unauthenticated Stored Cross-Site Scripting
Advanced Custom Fields: Extended
≤0.9.2.7Update to 0.9.2.8
- High8.8Authenticated (Contributor+) Remote Code Execution
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1068Update to 1.7.1069
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Mailster
≤1.9.1.0Update to 1.9.2.0