Database
WordPress Vulnerability Database (page 80)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) SQL Injection
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)
≤1.13.1Update to 1.13.6
- High8.1Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Local File Inclusion
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported )
≤2.3.3No patch available
- Medium6.5Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Arbitrary Shortcode Execution
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported )
≤2.3.3No patch available
- High8.1Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Unauthenticated Local File Inclusion
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported )
≤3.0.3No patch available
- Medium6.1Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Reflected Cross-Site Scripting
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported )
≤3.0.3No patch available
- High8.1Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Unauthenticated Local File Inclusion
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported)
≤1.4.8No patch available
- Medium6.1Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Reflected Cross-Site Scripting
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported)
≤1.4.8No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤9.2Update to 9.3
- High8.1Unauthenticated Local File Inclusion
CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor
≤1.5.0No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
ACF Frontend Admin by DynamiApps
≤3.29.13Update to 3.30.0
- High8.1Unauthenticated PHP Object Injection
payever Checkout – Composable Payment Gateway
≤4.8.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Slider by 10Web – Responsive Image Slider
≤1.2.63No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Food Menu – Restaurant Menu & Online Ordering for WooCommerce
≤6.0.5Update to 6.0.6
- Medium5.3Missing Authorization
grandnews
≤3.4No patch available
- Medium5.3Missing Authorization
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤16.2Update to 16.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Code Snippets
≤3.9.0Update to 3.10.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
QA Assistants – Driven by data
≤5.3.0.0Update to 5.3.0.1
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
MKL Product Configurator for WooCommerce – 2D & 3D Live Preview
≤1.7.5Update to 1.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Associate Post R2
≤5.0.1Update to 5.0.2
- High7.5Authenticated (Contributor+) PHP Object Injection
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium5.3Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Forgery
Super Payments – WooCommerce Payment Gateway
≤1.43.0Update to 1.43.1
- High7.2Authenticated (Administrator+) Arbitrary File Upload
AWP Classifieds
≤4.4.8Update to 4.4.9
- High7.5Unauthenticated Denial of Service
WP Rocket
<3.23.5Update to 3.23.5
- High8.1Unauthenticated Local File Inclusion
The Voux - A Multipurpose News & Magazine WordPress Theme
≤6.9.5No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
colorit
≤1.3No patch available
- High8.1Creative Portfolio WordPress Theme <= 4.8.3 - Unauthenticated Local File Inclusion
Werkstatt - Creative Portfolio WordPress Theme
≤4.8.3No patch available
- Medium6.1Sports Club <= 4.2 - Reflected Cross-Site Scripting
Whistle - Sports Clothing & Fitness Equipment
≤4.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Ogency - Web Design Agency WordPress Theme
≤1.0.0No patch available
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
FooSales – Point of Sale (POS) for WooCommerce
≤1.43.2Update to 1.43.3
- Medium5.3Missing Authorization
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)
≤1.13.1Update to 1.13.6