Database
WordPress Vulnerability Database (page 72)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium4.3Cross-Site Request Forgery
Hotel Booking
≤3.8No patch available
- Medium5.3Missing Authorization
Fundiin cho WooCommerce
≤3.4.0No patch available
- High7.5Unauthenticated SQL Injection
Tcard WP
≤1.8.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium5.3Missing Authorization
Restrict User Access – Ultimate Membership & Content Protection
≤2.8.1Update to 2.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.5Update to 3.13.6
- High8.1Unauthenticated Local File Inclusion
TouchUp - Cosmetic and Plastic Surgery WordPress Theme
<1.4Update to 1.4
- Medium6.5Authenticated (Contributor+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
4.0.0 – <4.1.0Update to 4.1.0
- Medium4.3Missing Authorization
Squadeno – Club Sports Manager
≤1.11.0Update to 1.12.0
- Medium4.3Authenticated (Subscriber+) Payment Bypass
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
≤3.2.9Update to 3.2.10
- Medium4.3Missing Authorization
AutoPoly – AI Translation For Polylang
≤1.6.2Update to 1.6.3
- Medium5.3Missing Authorization
WeddingCity Lite – Wedding Directory and Listing
≤1.0.4No patch available
- High7.2Authenticated (Admin+) Arbitrary Plugin Installation
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Critical9.8Unauthenticated Arbitrary File Upload
Anton Extensions
≤1.2.2No patch available
- Medium4.3Authenticated (Subscriber+) Information Exposure
WP-Invoice – Web Invoice and Billing
≤4.3.1No patch available
- High7.5Unauthenticated SQL Injection
Datalist it
≤0.0.3No patch available
- Medium5.3Missing Authorization
WP Posts Password Batch Manager
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
WP-Partner
≤1.2.1No patch available
- High7.5Unauthenticated SQL Injection
Llavero.io
≤0.1.4No patch available
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
Mindstien Quick Login
≤1.0No patch available
- Medium5.3Missing Authorization
click5 CRM add-on to Gravity Forms
≤1.0.3No patch available
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetBlocks for Elementor
≤1.5.2.1Update to 1.5.2.2
- Medium5.3Missing Authorization
Scripts n Styles
≤3.5.8No patch available
- Medium4.3Missing Authorization
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
≤3.4.1Update to 3.4.2
- Medium5.3Missing Authorization
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2