Database
WordPress Vulnerability Database (page 83)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
WCFM – Multivendor Marketplace REST API for WooCommerce
≤1.6.3No patch available
- High7.5Unauthenticated SQL Injection
SendPress Newsletters
≤1.26.1.20No patch available
- Medium5.3Missing Authorization
Advanced Posts Listing – Show Post List Easily
≤1.0.8No patch available
- Medium5.3Missing Authorization
10WebSocial
≤1.4.35No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Front End PM
≤11.4.6Update to 11.4.7
- Medium5.3Unauthenticated Information Exposure
Mailjet Email Marketing
≤6.2.3Update to 6.2.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Ansar Import – Starter Sites & Template Library
≤2.1.2Update to 2.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.3.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Document Gallery
≤5.1.1Update to 5.1.2
- High7.5Unauthenticated SQL Injection
Gmedia Photo Gallery
≤1.25.1Update to 1.25.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Hotel Booking
≤3.8No patch available
- High7.3Unauthenticated Privilege Escalation
Doctreat Core
≤1.7.0No patch available
- Medium6.3Job Board WordPress Theme <= 2.2 - Authenticated (Subscriber+) Privilege Escalation
JobZilla - Job Board WordPress Theme
≤2.2No patch available
- High7.2Authenticated (Editor+) Remote Code Execution
Tabs Responsive – With WooCommerce Product Tabs Extension
≤2.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.7Update to 1.4.8
- Critical9.8Hospitals and Doctors Directory WordPress Listing Theme <= 1.7.0 - Unauthenticated Arbitrary File Upload
Doctreat - Hospitals and Doctors Directory WordPress Listing Theme
≤1.7.0No patch available
- Medium6.5Authenticated (Subscriber+) Denial of Service
WPBase Cache
≤5.5.6Update to 5.5.7
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤4.0.1Update to 4.0.2
- Medium5.3Missing Authorization
The7 — Website and eCommerce Builder for WordPress
≤14.2.2No patch available
- Medium5.3Missing Authorization
Autoship Cloud for WooCommerce Subscription Products
≤2.17.1No patch available
- High7.5Unauthenticated SQL Injection
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events
≤1.0.21Update to 1.0.22
- Medium4.7Authenticated (Shop Manager+) Privilege Escalation
PDF Invoices & Packing Slips for WooCommerce – Challan Invoice Plugin
≤3.7.88No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
ARforms
≤7.1.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Video Background Block – Add Stunning Video Backgrounds to Any Section
≤2.0.3Update to 2.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.6Update to 4.4.7
- Medium5.3Missing Authorization
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.1Update to 3.7.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Rocket – Social Sharing Plugin
≤1.3.5Update to 1.3.6
- High7.5Unauthenticated SQL Injection
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤7.9.0Update to 7.9.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
uDesign | Multipurpose WordPress Theme
≤4.15.0No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
ListingPro Plugin
≤2.9.12No patch available