Database
WordPress Vulnerability Database (page 74)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission
≤7.0No patch available
- High8.1Food & Wine Store WordPress Theme <= 3.20 - Unauthenticated PHP Object Injection
WineShop - Food & Wine Store WordPress Theme
≤3.20No patch available
- High8.1Unauthenticated PHP Object Injection
Equadio
≤1.1.4No patch available
- High8.1Unauthenticated PHP Object Injection
N7
≤2.21No patch available
- High8.1Unauthenticated PHP Object Injection
Invetex
≤2.18No patch available
- High8.1Unauthenticated PHP Object Injection
Law Office
≤3.20No patch available
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators
≤1.2.21Update to 1.2.22
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
WPML Multilingual & Multicurrency for WooCommerce
≤5.5.8Update to 5.6.3
- High8.1Unauthenticated PHP Object Injection
AFFI – Affiliate Marketing for WooCommerce
≤1.0.10Update to 1.0.11
- High7.5Unauthenticated SQL Injection
Tickera – Sell Tickets & Manage Events
≤3.6.0.6Update to 3.6.0.7
- Medium5.3Missing Authorization
GIFT4U – Gift Cards All in One for Woo
≤1.1.3Update to 1.1.4
- Medium4.711.1.2 - Authenticated (Shop Manager+) Privilege Escalation
WooCommerce
9.8.0 – 11.1.2Update to 11.2.0
- Medium4.3Missing Authorization
Jetpack VideoPress
≤3.6Update to 3.7
- High8.1Unauthenticated PHP Object Injection
asia-garden
≤1.3.1No patch available
- Medium5.3Missing Authorization
Bayarcash WooCommerce
≤4.4.2Update to 4.4.3
- Medium6.6Authenticated (Editor+) PHP Object Injection
Super Video player – Fully Customizable Video Player with Playlist
≤1.8.14Update to 1.8.15
- Medium5.3Unauthenticated Information Exposure
WP Rollback – Rollback Plugins and Themes
≤3.1.2Update to 3.2.0
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.3Update to 1.58.0
- Medium6.1Reflected Cross-Site Scripting
WPAdverts – Classifieds Plugin
≤2.3.4Update to 2.3.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPAdverts – Classifieds Plugin
≤2.3.4Update to 2.3.5
- High8.1Unauthenticated PHP Object Injection
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤8.4.0Update to 8.5.0
- High7.5Authenticated (Custom Role+) PHP Object Injection
Tainacan
≤1.3.0Update to 1.4.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Slider by 10Web – Responsive Image Slider
≤1.2.62Update to 1.2.63
- High7.2Unauthenticated Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.3Update to 1.58.0
- Medium5.3Missing Authorization
Sell Downloads
≤1.2.3Update to 1.2.4
- High8.1Blog Magazine Theme <= 2.2.1 - Unauthenticated PHP Object Injection
Kicker - Blog Magazine Theme
≤2.2.1No patch available
- High8.1Unauthenticated PHP Object Injection
jacqueline
≤2.22No patch available
- High8.1Unauthenticated PHP Object Injection
Alliance | Intranet & Extranet BuddyPress WordPress Theme
≤3.11No patch available
- High8.1Blog \ Resume \ Portfolio \ WordPress Theme <= 3.0.14 - Unauthenticated PHP Object Injection
ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme
≤3.0.14No patch available
- High8.1Apartment Complex Single Property WordPress Theme <= 2.10 - Unauthenticated PHP Object Injection
Windsor - Apartment Complex Single Property WordPress Theme
≤2.10No patch available