Database
WordPress vulnerabilities listed in CISA KEV (page 101)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated Denial of Service
Two Factor
≤0.16.0Update to 0.17.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
ReactPress
≤3.4.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Viable URL Media Uploader
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Post Views Stats Counter
≤1.1.7No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter
Real Estate Manager – Property Listing and Agent Management
≤7.3Update to 7.4
- High7.5Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
Product Designer App
≤1.1.3No patch available
- Medium6.5Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
Smart Slider 3
≤3.5.1.38Update to 3.5.1.39
- High7.5Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
Motors – Car Dealership & Classified Listings Plugin
≤1.4.109Update to 1.4.110
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤3.1.1Update to 3.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Bold Page Builder
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter
Bold Page Builder
≤5.7.2Update to 5.7.3
- High7.5Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
Simply Schedule Appointments
≤1.6.12.27Update to 1.6.12.33
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms
≤1.3.4Update to 1.3.5
- Medium4.3Missing Authorization
AllAble Connector
≤0.13.4Update to 0.13.6
- Medium5.3Unauthenticated Information Exposure
BackupEase – Scheduled Backup, Restore & Site Migration
≤2.2.2Update to 2.2.3
- Medium5.3Unauthenticated Information Exposure
StifLi Backup Tools
≤2.2.7Update to 2.2.8
- Critical9.8Unauthenticated Remote Code Execution
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP
≤2.1.8Update to 2.2.0
- Medium6.5Authenticated (Contributor+) Path Traversal
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators
≤1.2.19Update to 1.2.20
- Medium4.3Missing Authorization
MCP Content Manager Lite
≤1.1.0Update to 1.2.0
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Music Player for WooCommerce
≤1.9.1Update to 1.9.2
- High7.5Authenticated (Subscriber+) PHP Object Injection
WPBot – ChatBot Conversational Forms
≤1.5.0Update to 1.5.1
- Medium4.3Missing Authorization
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
≤1.12.2Update to 1.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
JW Player for WordPress
≤2.3.11Update to 2.3.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Geo Mashup
≤1.13.21Update to 1.13.22
- Medium5.3Missing Authorization
WP Express Checkout (Fast Payments via PayPal & Stripe)
≤2.4.9Update to 2.5.0
- Medium6.6Authenticated (Editor+) PHP Object Injection
Responsive Slider Gallery – Responsive Image Photo Slider
≤1.5.5Update to 1.5.6