Database
WordPress Vulnerability Database (page 78)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Ambed - Wallpapers & Painting Services WordPress Theme
≤1.0.0No patch available
- Medium4.3Authenticated (Subscriber+) Race Condition
Tutor LMS – eLearning and online course solution
≤4.1.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.2.4No patch available
- Medium6.5Authenticated (Author+) Path Traversal
W3 Total Cache
≤2.10.5Update to 2.10.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
HollerBox — Fast & Effective Popups & Lead-Generation
≤2.3.14Update to 2.3.15
- Medium4.32.2.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Portfolio Filter Gallery – Photo Gallery
2.0.2 – 2.2.0Update to 2.2.1
- Critical9.1Unauthenticated Arbitrary File Deletion
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.13Update to 4.7.14
- Medium4.3Missing Authorization
Event Tickets and Registration
≤5.30.0.1Update to 5.30.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.12Update to 3.7.12.1
- Medium4.3Missing Authorization
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets
≤4.5.5Update to 4.5.6
- Medium4.3Cross-Site Request Forgery
Database Addon For WPForms ( wpforms entries ) – WPFormsDB
<1.1.1Update to 1.1.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
<5.7.3Update to 5.7.3
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
<5.6.9Update to 5.6.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<3.7.1Update to 3.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.52Update to 3.7.53
- Medium6.5Authenticated (Custom Role+) SQL Injection
Vitepos – Point of Sale (POS) for WooCommerce
≤3.6.1Update to 3.6.2
- Medium4.9Authenticated (Administrator+) SQL Injection
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.279Update to 1.0.280
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Image Photo Gallery Final Tiles Grid
<3.6.14Update to 3.6.14
- High7.33.0.4 - Unauthenticated Privilege Escalation
Frontend Dashboard
3.0.0 – 3.0.4Update to 3.0.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Thanko Thank You Page Customizer for WooCommerce
≤1.2.3Update to 1.2.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- Critical9.1Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- High8.1Multipurpose eCommerce Template <= 1.3.0 - Unauthenticated Local File Inclusion
Duka Market - Multipurpose eCommerce Template
≤1.3.0No patch available
- High8.1Multipurpose WooCommerce Theme <= 1.0.9 - Unauthenticated Local File Inclusion
Uminex - Multipurpose WooCommerce Theme
≤1.0.9No patch available
- Medium5.3Missing Authorization
DK
≤3.2.1No patch available
- Medium6.1Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 - Reflected Cross-Site Scripting
Kids Planet - Children Kindergarten and Playgroup WordPress Theme
≤2.2.14.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤4.0.0Update to 4.0.1
- Medium6.5Authenticated (Author+) SQL Injection
Slider by 10Web – Responsive Image Slider
≤1.2.63No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.6.1.1Update to 7.7.0
- Medium5.4Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.9Update to 5.6.10