Database
WordPress Vulnerability Database (page 65)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.13Update to 7.5.14
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetMenu
≤3.0.5Update to 3.0.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.3Update to 2.9.2.4
- Medium4.3Missing Authorization
Flexible Subscriptions
≤1.8.4Update to 1.8.5
- Medium4.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.22Update to 2.9.23
- Medium5.3Missing Authorization
Products Restricted Users for WooCommerce
≤0.7Update to 0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Query Blocks
≤5.6.0Update to 5.7.0
- Medium4.3Missing Authorization
Event Post
≤6.1.1Update to 6.1.2
- Medium4.3Missing Authorization
TMDS – Dropshipping for TEMU and Woo
≤1.0.15Update to 1.0.16
- Medium4.3Missing Authorization
VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok
≤1.2.10Update to 1.2.11
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Post
≤6.1.1Update to 6.1.2
- Medium5.3Missing Authorization
Bus Ticket Booking with Seat Reservation
≤5.9.7Update to 5.9.8
- Medium5.3Missing Authorization
Push Notification for Post and BuddyPress
≤3.23Update to 3.24
- Medium6.6Authenticated (Editor+) PHP Object Injection
Polylang
≤3.8.9Update to 3.8.10
- High8.1Real Estate WordPress Theme <= 1.3.13 - Unauthenticated PHP Object Injection
Good Homes - Real Estate WordPress Theme
≤1.3.13No patch available
- High8.1Unauthenticated PHP Object Injection
gamezone
≤1.1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Edge Decor
≤2.9No patch available
- High8.1Unauthenticated PHP Object Injection
Bonbon
≤1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Filmax | Cinema & Movie News Magazine WordPress Theme
≤1.1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Nuts
≤1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Mission
≤1.22No patch available
- High8.1Unauthenticated PHP Object Injection
Le Truffe
≤1.1.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Property Listings
≤3.5.25Update to 3.5.26
- Medium5.3Unauthenticated Race Condition
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.8No patch available
- High8.1Unauthenticated PHP Object Injection
Affiliates
≤7.0.1Update to 7.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.16Update to 3.8.16.1
- Medium5.3Missing Authorization
WP OAuth Server ( Login with WordPress )
≤6.4.0Update to 6.5.0
- Medium5.3Missing Authorization
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.6Update to 3.6.6.1