Database
WordPress Vulnerability Database (page 77)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Booking Package
≤1.7.29Update to 1.7.30
- Medium5.3Unauthenticated Information Exposure
Accept PayPal Payments using Contact Form 7
≤4.0.6Update to 4.0.7
- Medium5.3Missing Authorization
Accept PayPal Payments using Contact Form 7
≤4.0.6Update to 4.0.7
- Medium4.3Missing Authorization
Portfolio Filter Gallery – Photo Gallery
≤2.2.0Update to 2.2.1
- Medium5.3Missing Authorization
Event Tickets and Registration
≤5.30.0.1Update to 5.30.0.2
- Medium5.3Unauthenticated Information Exposure
Booking Calendar
<11.8Update to 11.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.1.6Update to 5.2.6
- Medium5.3Missing Authorization
YITH WooCommerce Product Bundles
≤2.29.0Update to 2.30.0
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
<5.6.5Update to 5.6.5
- Low2.711.8.2 - Authenticated (Editor+) Information Exposure
Booking Calendar
10.15 – 11.8.2Update to 11.8.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Store Locator
≤3.0.3Update to 3.1.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.279Update to 1.0.280
- High7.2Authenticated (Administrator+) Arbitrary File Upload
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.279Update to 1.0.280
- High7.2Unauthenticated Stored Cross-Site Scripting
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
<2.34.14Update to 2.34.14
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
≤6.5.6Update to 6.6.0
- High8.1One Page Resume WordPress Theme <= 1.0 - Unauthenticated Local File Inclusion
Fabius - One Page Resume WordPress Theme
≤1.0No patch available
- Medium5.3Unauthenticated Unauthorized Account Activation
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤33.0.0Update to 33.0.1
- Medium5.3Unauthenticated Information Exposure
Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping
<1.2.7Update to 1.2.7
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
<2.8.0Update to 2.8.0
- Medium4.3Missing Authorization
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
<2.8.0Update to 2.8.0
- Medium4.3Missing Authorization
Grocery Shopping Store
≤1.3.5Update to 1.3.6
- High7.54.2.18 - Unauthenticated SQL Injection
LTL Freight Quotes – ODFL Edition
4.2.11 – 4.2.18Update to 4.2.19
- High7.2Unauthenticated Stored Cross-Site Scripting
LTL Freight Quotes – ODFL Edition
≤4.2.18Update to 4.2.19
- Medium4.9Authenticated (Administrator+) Path Traversal
BackWPup – WordPress Backup & Restore Plugin
<5.7.7Update to 5.7.7
- Medium5.3Unauthenticated Information Exposure
BackWPup – WordPress Backup & Restore Plugin
<5.7.7Update to 5.7.7
- High7.2Unauthenticated Stored Cross-Site Scripting
LMS - Education WordPress Theme
≤8.3No patch available
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
FoodBakery | Food Delivery Single & Multiple Restaurant Template
≤4.6No patch available
- High8.1Unauthenticated PHP Object Injection
FC United | Football, Soccer & Sports WordPress Theme + Events & Shop
≤1.1.1No patch available
- High8.1Authenticated (Author+) Arbitrary File Deletion
Presto Player Pro
≤3.0.1Update to 3.0.2
- Medium4.3Cross-Site Request Forgery
WPComplete
≤2.9.5.6Update to 2.9.5.7