Database
WordPress Vulnerability Database (page 66)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar Lite
<7.37.0Update to 7.37.0
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Disclosure
Booster Elite for WooCommerce
<8.4.0Update to 8.4.0
- Medium6.1Reflected Cross-Site Scripting
Marin
≤0.1.1Update to 0.1.2
- Critical9.1Unauthenticated Arbitrary File Deletion
File Upload to Order for WooCommerce
≤1.1.3Update to 1.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.12Update to 7.5.13
- Medium5.3Unauthenticated Session Hijacking
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.2Update to 7.3.3
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.22Update to 2.3.23
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.3Update to 4.9.4
- Medium6.5Unauthenticated Arbitrary Shortcode Injection
Mailonix – Email Template Customizer for WooCommerce
≤1.3.4Update to 1.3.5
- High7.3Unauthenticated Arbitrary Shortcode Execution
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- High8.1Unauthenticated PHP Object Injection
Gunslinger
≤1.11No patch available
- High8.1Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection
Gamic - Gaming Metaverse Game & Crypto WordPress Theme
≤1.19No patch available
- High8.1Unauthenticated PHP Object Injection
EmojiNation
≤1.0.12No patch available
- High8.1Unauthenticated PHP Object Injection
Coinpress
≤1.0.15No patch available
- High8.1Unauthenticated PHP Object Injection
Avventure
≤1.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Orpheus
≤1.8No patch available
- High8.1Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection
Muzicon - Music Festival & Concert WordPress Theme
≤1.15No patch available
- High8.1Unauthenticated PHP Object Injection
Motorix
≤1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Meals & Wheels
≤1.1.13No patch available
- High8.1Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
Marcell - Personal Blog & Magazine WordPress Theme
≤1.2.14No patch available
- High8.1Unauthenticated PHP Object Injection
Legal Stone | Lawyers & Attorneys WordPress Theme
≤1.2.11No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Auction Nudge – Your eBay Listings
≤8.4.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
JetProductTables
≤1.2.4Update to 1.2.4.1
- Medium4.37.1 - Missing Authorization
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments
6.1 – 7.1Update to 7.2
- Medium4.3Missing Authorization
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤5.0.19No patch available
- Medium4.3Missing Authorization
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
≤2.2.4Update to 2.2.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool
≤3.0.0Update to 4.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
PeproDev Ultimate Profile Solutions
≤8.2.36Update to 8.2.37
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.31Update to 1.7.32
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤6.1.2Update to 6.2.0