CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 44)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Responsive WordPress Theme <= 7.0 - Unauthenticated PHP Object Injection
Hostme v2 - Responsive WordPress Theme
≤7.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium6.5Authenticated (Subscriber+) SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤8.0.7Update to 8.0.8
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium5.3Missing Authorization
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
≤9.6.3.0Update to 9.6.3.1
- Medium5.3Missing Authorization
WPMobile.App – Android and iOS App Builder
≤11.86Update to 11.87
- Medium4.34.0.4 - Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
4.0.0 – 4.0.4Update to 4.0.5
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
<3.3.3Update to 3.3.3
- Medium5.3Missing Authorization
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
<34.0.1Update to 34.0.1
- Medium5.3Unauthenticated Information Exposure
Booking Package
<1.7.31Update to 1.7.31
- Medium5.34.1.20 - Missing Authorization to Unauthenticated Maintenance Mode Bypass
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
4.1.19 – 4.1.20Update to 4.1.21
- Medium4.3Missing Authorization
News Kit Addons For Elementor
≤1.4.7No patch available
- Medium4.3Missing Authorization
SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher
<5.3.5No patch available
- High7.2Creative eCommerce Multi-Purpose WordPress Theme <= 4.25.0 - Unauthenticated Stored Cross-Site Scripting
KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme
≤4.25.0No patch available
- High8.1Unauthenticated PHP Object Injection
Little Birdies | Multipurpose Children PSD Template
≤1.3.16No patch available
- High8.1Business Portfolio Elementor Blocks & Template Kit <= 1.3.3 - Unauthenticated PHP Object Injection
Rhodos - Business Portfolio Elementor Blocks & Template Kit
≤1.3.3No patch available
- High8.1Unauthenticated PHP Object Injection
Hallelujah | Religion & Church Charity WordPress Theme
≤1.1.1No patch available
- High8.1Unauthenticated Local File Inclusion
Your Dress | Dress Rental & Clothing Store WordPress Theme + Shop
≤1.4.1No patch available
- High7.2Responsive WordPress Theme <= 7.0 - Unauthenticated Stored Cross-Site Scripting
Hostme v2 - Responsive WordPress Theme
≤7.0No patch available
- High8.1Unauthenticated PHP Object Injection
ZenSoul - Spa Salon & Wellness WordPress Theme + Shop & AI
≤1.13No patch available
- Medium4.3Missing Authorization
Car Rental Manager – Online Vehicle Booking System
≤1.5.3Update to 1.5.4
- Medium4.3Missing Authorization
MAS Videos
<1.3.5Update to 1.3.5
- Medium4.3Missing Authorization
Advanced Twenty Seventeen
≤1.3.1No patch available
- Medium5.3Unauthenticated Payment Forgery
Payment Gateway for Telcell
<2.0.5Update to 2.0.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Participants Database
≤2.7.8.5No patch available
- Medium4.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.25Update to 2.9.26
- Medium5.3Missing Authorization
Bus Ticket Booking with Seat Reservation
≤5.9.7Update to 5.9.8
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.30Update to 1.0.31
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rootblox – Header & Footer Builder for Full Site Editing (FSE)
≤1.0.7Update to 1.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6