Database
WordPress Vulnerability Database (page 78)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators
≤1.2.21Update to 1.2.22
- High8.1Unauthenticated PHP Object Injection
Juno | Kids Toys & Games Store WordPress Theme
≤2.25No patch available
- High8.1Unauthenticated PHP Object Injection
Avala - Wedding & Event WordPress Theme
≤1.1.4No patch available
- High8.1Unauthenticated Local File Inclusion
Teoro - One Page WordPress Theme
≤1.1No patch available
- High8.1Unauthenticated Local File Inclusion
Volos - One Page Resume WordPress Theme
≤1.2No patch available
- High8.1Unauthenticated Local File Inclusion
Cardea - Portfolio One Page WordPress Theme
≤2.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Ambed - Wallpapers & Painting Services WordPress Theme
≤1.0.0No patch available
- Medium4.3Authenticated (Subscriber+) Race Condition
Tutor LMS – eLearning and online course solution
≤4.1.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.2.4No patch available
- Medium6.5Authenticated (Author+) Path Traversal
W3 Total Cache
≤2.10.5Update to 2.10.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
HollerBox — Fast & Effective Popups & Lead-Generation
≤2.3.14Update to 2.3.15
- Medium4.32.2.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Portfolio Filter Gallery – Photo Gallery
2.0.2 – 2.2.0Update to 2.2.1
- Critical9.1Unauthenticated Arbitrary File Deletion
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.13Update to 4.7.14
- Medium4.3Missing Authorization
Event Tickets and Registration
≤5.30.0.1Update to 5.30.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.12Update to 3.7.12.1
- Medium4.3Missing Authorization
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets
≤4.5.5Update to 4.5.6
- Medium4.3Cross-Site Request Forgery
Database Addon For WPForms ( wpforms entries ) – WPFormsDB
<1.1.1Update to 1.1.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
<5.7.3Update to 5.7.3
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
<5.6.9Update to 5.6.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<3.7.1Update to 3.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.52Update to 3.7.53
- Medium6.5Authenticated (Custom Role+) SQL Injection
Vitepos – Point of Sale (POS) for WooCommerce
≤3.6.1Update to 3.6.2
- Medium4.9Authenticated (Administrator+) SQL Injection
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.279Update to 1.0.280
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Image Photo Gallery Final Tiles Grid
<3.6.14Update to 3.6.14
- High7.33.0.4 - Unauthenticated Privilege Escalation
Frontend Dashboard
3.0.0 – 3.0.4Update to 3.0.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Thanko Thank You Page Customizer for WooCommerce
≤1.2.3Update to 1.2.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- Critical9.1Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- High8.1Multipurpose eCommerce Template <= 1.3.0 - Unauthenticated Local File Inclusion
Duka Market - Multipurpose eCommerce Template
≤1.3.0No patch available
- High8.1Multipurpose WooCommerce Theme <= 1.0.9 - Unauthenticated Local File Inclusion
Uminex - Multipurpose WooCommerce Theme
≤1.0.9No patch available