Database
WordPress vulnerabilities listed in CISA KEV (page 110)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Online Booking & Scheduling Calendar by vcita
≤4.6.0Update to 4.6.3
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Reycob Product Import Export
≤2.3.0Update to 2.4.0
- Medium5.3Missing Authorization
Tangible: Loops & Logic
≤4.2.4Update to 4.3.0
- Medium5.3Missing Authorization
Conekta Payment Gateway
≤6.2.4Update to 6.2.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Mang Board
≤2.4.1Update to 2.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Photo Album Plus
≤9.3.02.002Update to 9.3.02.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
wpForo Forum
≤3.1.5Update to 3.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.1.1Update to 5.5.1.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Event Tickets and Registration
≤5.29.4Update to 5.29.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPS Limit Login
≤1.5.9.3Update to 1.5.9.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
PixelYourSite – Your smart PIXEL (TAG) & API Manager
≤11.4.1Update to 11.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium5.3Missing Authorization
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)
≤3.15.4Update to 3.15.5
- Medium4.9Authenticated (Administrator+) SQL Injection
Email Log
≤2.63Update to 2.64
- Medium4.9Authenticated (Editor+) SQL Injection
Ultimeter – the Ultimate Progress and Goals Meter
≤3.0.8Update to 3.1.0
- Medium6.5Authenticated (Contributor+) SQL Injection
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.4Update to 6.0.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Mollie Forms
≤2.11.0Update to 2.11.1
- Medium6.5Authenticated (Contributor+) SQL Injection
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator
≤1.5.10Update to 1.5.11
- Medium4.3Missing Authorization
Fluent Support – Helpdesk & Customer Support Ticket System
≤2.3.2Update to 2.4.0
- Medium4.9Authenticated (Shop Manager+) SQL Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.0Update to 3.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Blocks – Gutenberg Blocks, Patterns & Templates
≤2.3.17Update to 2.3.18
- High8.8Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields
Import and export users and customers
≤2.4.17Update to 2.4.18
- Medium5.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.70Update to 2.1.72
- High8.1Unauthenticated Authentication Bypass
EthPress – Web3 Login
≤2.3.5Update to 2.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.5Update to 7.9.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
YITH Request a Quote for WooCommerce (Premium)
<4.46.1Update to 4.46.1
- High7.5Unauthenticated SQL Injection
Product Filter for WooCommerce by WBW
≤3.1.7Update to 3.1.8
- Medium4.3Missing Authorization to Authenticated (Contributor+) Unauthorized Post and Media Modification
WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
≤2.7.0Update to 2.7.1
- Medium5.3Unauthenticated Unauthorized User Registration
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium6.3Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12