Database
WordPress vulnerabilities listed in CISA KEV
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header
EZ SQL Reports Shortcode Widget and DB Backup
≤5.25.25Update to 5.26.45
- Critical9.8Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
Chatterbug Forms – Fast, Flexible WordPress Form Builder
≤1.0.2Update to 1.1
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
ELEX WordPress HelpDesk & Customer Ticketing System
≤3.3.9Update to 3.4.0
- Medium5.3Unauthenticated Sensitive Information Exposure in 'search' Parameter
Customer Reviews for WooCommerce
≤5.127.0Update to 5.128.0
- High8.2Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter
Drag and Drop File Upload for Elementor Forms
≤1.6.2Update to 1.6.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta
Newsletters
≤4.18.2Update to 4.18.3
- Medium6.5Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute
Easy Property Listings
≤3.5.28Update to 3.5.29
- Low2.7Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter
WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups
≤4.19.0Update to 4.20.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters
WPZOOM Addons for Elementor – Starter Templates & Widgets
≤1.4.20Update to 1.4.21
- Medium4.9Authenticated (Editor+) SQL Injection via 'sourceId' Parameter
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping
≤2.24.1Update to 2.24.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter
WPeMatico RSS Feed Fetcher
≤2.9.1Update to 2.9.2
- High8.8Authenticated (Contributor+) Code Injection via 'post_content' Parameter
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets
≤4.2.6.1Update to 4.2.7
- High8.8Authenticated (Custom+) Privilege Escalation to /suredash/v1/save-settings REST Endpoint
SureDash – Community, Courses & Member Dashboard
≤1.13.0Update to 1.13.1
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- High8.1Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.5.5Update to 4.5.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
Recipe Card Blocks Lite
≤3.7.0Update to 3.7.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'qpages' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.9Update to 11.3.0
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via [honeypot] Form-Tag Placeholder Value
CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)
≤3.8.0Update to 3.9.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter
Download Manager
6.0.0 – 7.6.3Update to 7.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter
Passster – Password Protect Pages and Content
≤4.3.21Update to 4.3.22
- High8.8Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()
VibeBP
≤1.9.9.8.1Update to 1.9.9.8.2
- High8.8Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint
CourseCure Courses
≤1.5.1Update to 1.5.3
- High8.8Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Masterstudy - Education WordPress Theme
≤4.8.151Update to 4.8.152
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'
WP Table Builder – Drag & Drop Table Builder
≤2.1.7Update to 2.1.8
- Critical9.1File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'
Ninja Forms - File Uploads
≤3.3.36Update to 3.3.37
- Medium5.3Missing Authorization
Passster – Password Protect Pages and Content
≤4.3.20Update to 4.3.21
- Medium4.3Cross-Site Request Forgery
vdperanto
≤2.2No patch available
- Medium4.3Cross-Site Request Forgery
VISeek – Easy Custom Search
≤1.0.5Update to 1.0.6
- Medium5.3Unauthenticated Information Exposure
Security For WooCommerce
≤1.0.16No patch available
- Medium5.3Unauthenticated Information Exposure
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.3Update to 3.1.4