Database
WordPress Vulnerability Database (page 81)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)
≤1.13.1Update to 1.13.6
- Medium6.1Reflected Cross-Site Scripting
kuteshop
≤4.2.9No patch available
- High8.1Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Unauthenticated Local File Inclusion
Biolife - Organic Food WordPress Theme ( RTL Supported )
≤3.2.3No patch available
- Medium6.1Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Reflected Cross-Site Scripting
Biolife - Organic Food WordPress Theme ( RTL Supported )
≤3.2.3No patch available
- High8.1Architecture and Interior Design WordPress Theme <= 1.8 - Unauthenticated Local File Inclusion
Aalto - Architecture and Interior Design WordPress Theme
≤1.8No patch available
- High8.1Unauthenticated PHP Object Injection
CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor
≤1.5.0No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
Dynamic User Directory
≤2.4No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
Leyka
≤3.32.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.47Update to 1.8.48
- Medium6.5Authenticated (Subscriber+) SQL Injection
Qode Tours
≤3.1.3.2No patch available
- High8.1Unauthenticated Local File Inclusion
Kids Care | Children & Child Care WordPress Theme
≤3.2.4No patch available
- Low2.7Missing Authorization
Code Snippets
≤3.9.0Update to 3.10.0
- Medium4.3Missing Authorization
Th Shop Mania
≤1.9.1Update to 1.9.2
- High7.2Unauthenticated Stored Cross-Site Scripting
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.1.0Update to 11.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤6.3.10Update to 6.3.11
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Metadata
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.2Update to 2.9.2.3
- Medium5.37.0.2 - Missing Authorization
Livees Checkout
6.8 – 7.0.2Update to 7.0.3
- High7.27.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments
WordPress
7.1.0 – 7.1.2Update to 7.1.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Update
Pubjet | پابجت
≤5.4.8No patch available
- Medium5.3Unauthenticated Information Exposure
SendPress Newsletters
≤1.26.1.20No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.6Update to 7.4.7
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
peepso
≤9.0.5.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Additional Order Filters for WooCommerce
≤1.24No patch available
- High7.5Unauthenticated SQL Injection
Travel Booking WordPress Theme
≤3.2.9Update to 3.3
- Medium5.3Missing Authorization
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- Medium5.31.19.8 - Missing Authorization
Shipping for Nova Poshta
1.18.7 – 1.19.8No patch available
- Medium5.3Missing Authorization
UnitechPay – Wave & Orange Money Payments
≤1.0.6.3No patch available
- Medium4.31.7.1 - Cross-Site Request Forgery
GDPR Data Request Form
1.5 – 1.7.1Update to 1.8
- High7.2Unauthenticated Stored Cross-Site Scripting
FV Player 8
≤8.1.8Update to 8.1.9