Database
WordPress Vulnerability Database (page 66)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Frontend Dashboard
≤3.0.7Update to 3.0.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP w3all phpBB
≤3.1.0Update to 3.1.2
- High7.5Authenticated (Custom Role+) PHP Object Injection
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar Lite
<7.37.0Update to 7.37.0
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Disclosure
Booster Elite for WooCommerce
<8.4.0Update to 8.4.0
- Medium6.1Reflected Cross-Site Scripting
Marin
≤0.1.1Update to 0.1.2
- Critical9.1Unauthenticated Arbitrary File Deletion
File Upload to Order for WooCommerce
≤1.1.3Update to 1.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium5.3Unauthenticated Session Hijacking
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.2Update to 7.3.3
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.22Update to 2.3.23
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- Medium6.5Unauthenticated Arbitrary Shortcode Injection
Mailonix – Email Template Customizer for WooCommerce
≤1.3.4Update to 1.3.5
- High7.3Unauthenticated Arbitrary Shortcode Execution
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- High8.1Unauthenticated PHP Object Injection
Gunslinger
≤1.11No patch available
- High8.1Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection
Gamic - Gaming Metaverse Game & Crypto WordPress Theme
≤1.19No patch available
- High8.1Unauthenticated PHP Object Injection
EmojiNation
≤1.0.12No patch available
- High8.1Unauthenticated PHP Object Injection
Coinpress
≤1.0.15No patch available
- High8.1Unauthenticated PHP Object Injection
Avventure
≤1.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Orpheus
≤1.8No patch available
- High8.1Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection
Muzicon - Music Festival & Concert WordPress Theme
≤1.15No patch available
- High8.1Unauthenticated PHP Object Injection
Motorix
≤1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Meals & Wheels
≤1.1.13No patch available
- High8.1Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
Marcell - Personal Blog & Magazine WordPress Theme
≤1.2.14No patch available
- High8.1Unauthenticated PHP Object Injection
Legal Stone | Lawyers & Attorneys WordPress Theme
≤1.2.11No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Auction Nudge – Your eBay Listings
≤8.4.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
JetProductTables
≤1.2.4Update to 1.2.4.1
- Medium4.37.1 - Missing Authorization
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments
6.1 – 7.1Update to 7.2
- Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.19No patch available