Database
WordPress Vulnerability Database (page 76)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Newspaper Magazine News BuddyPress AMP <= 7.6.7 - Unauthenticated Stored Cross-Site Scripting
Jannah - Newspaper Magazine News BuddyPress AMP
≤7.6.7Update to 7.6.8
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
YITH WooCommerce Affiliates
≤3.31.0Update to 3.31.1
- Medium4.3Missing Authorization
VillaTheme Core
≤1.0.5Update to 1.0.6
- Medium6.1Reflected Cross-Site Scripting
ThemeStek Extras for LabtechCO Theme
≤8.4No patch available
- Critical9.8Unauthenticated Arbitrary Account Takeover
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤4.0.0Update to 4.0.1
- Medium4.3Missing Authorization
Event Tickets and Registration
≤5.30.0.1Update to 5.30.0.2
- Medium5.3Missing Authorization
GiveWP – Donation Plugin and Fundraising Platform
≤4.18.0Update to 4.18.0.1
- Medium6.3Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
<2.8.0Update to 2.8.0
- High7.34.0.0 - Unauthenticated Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
3.9.6 – 4.0.0Update to 4.0.1
- Low2.74.0.0 - Authenticated (Administrator+) Information Exposure
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
3.6.4 – 4.0.0Update to 4.0.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
<2.8.0Update to 2.8.0
- Medium4.3Missing Authorization
MemberHero – Simple User Registration & Login
≤6.9No patch available
- Medium6.1Reflected Cross-Site Scripting
Zeinet - Internet Provider & Satellite TV
≤1.0.0No patch available
- High8.1Unauthenticated PHP Object Injection
Balance
≤1.12.0No patch available
- High8.1Unauthenticated PHP Object Injection
Veto - Politics, Campaign & Candidate WordPress Theme
≤1.6.0No patch available
- Medium5.35.7.6 - Missing Authorization
BackWPup – WordPress Backup & Restore Plugin
3.3 – 5.7.6Update to 5.7.7
- Medium4.34.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference
Tutor LMS – eLearning and online course solution
4.0.5 – 4.1.0Update to 4.1.1
- High8.1Unauthenticated PHP Object Injection
Original
≤1.9.0No patch available
- High8.1Unauthenticated Local File Inclusion
Ambient - Modern Interior Design and Decoration WordPress Theme
≤1.7No patch available
- High8.1Unauthenticated PHP Object Injection
Education Center | LMS & Online Courses WordPress Theme
≤3.6.12No patch available
- Medium5.3Unauthenticated Information Exposure
YITH WooCommerce Product Add-Ons
≤4.34.0Update to 4.34.1
- Medium4.3Cross-Site Request Forgery
WP 2FA – Two-factor authentication for WordPress
≤4.1.0Update to 4.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Plugin Info Card – Showcase Beautiful Plugin Cards, Theme Cards, and GitHub Repos Anywhere
≤6.3.5Update to 6.4.0
- High8.1Unauthenticated PHP Object Injection
Kalles - Clean, Versatile, Responsive Shopify Theme - RTL support
≤1.1.7.1No patch available
- High8.1Unauthenticated Local File Inclusion
Backhoe - Construction Equipment Rentals WordPress Theme
≤2.0No patch available
- High8.1Unauthenticated Local File Inclusion
Kaven - Business One Page WordPress Theme
≤1.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Zotpress
≤7.4.4Update to 7.4.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.5Update to 1.3.6
- Medium4.3Cross-Site Request Forgery
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.3Update to 1.58.0
- Medium4.3Missing Authorization
Visual Composer Website Builder
≤45.16.3Update to 45.16.4