Database
WordPress vulnerabilities listed in CISA KEV (page 113)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
WPC Product Bundles for WooCommerce
≤8.6.6Update to 8.6.7
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action
RW Elephant Rental Inventory
≤2.3.13Update to 2.4.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
Custom Field Template
≤2.7.8Update to 2.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
TranslatePress – Translate Multilingual sites with AI Translation
≤3.3.5Update to 3.3.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
Contextual Related Posts
≤4.4.1Update to 4.4.2
- High7.2Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.17Update to 4.1.18
- Medium6.1Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
Booking Calendar
≤11.8.3Update to 11.8.4
- Critical9.8Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
Meta Box User Profile
≤2.5.16Update to 2.6.0
- Critical9.8Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
Give Tributes
≤2.3.1Update to 2.3.1.1
- Medium4.9Authenticated (Administrator+) SQL Injection
HashBar – Announcement, Notification Bar & Popup Campaign
≤2.0.3Update to 2.0.4
- Medium4.3Missing Authorization
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.3Update to 5.4
- Medium4.38.9.4 - Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads
3.1.0 – 8.9.4Update to 8.9.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JSM Show Post Metadata
≤4.9.0Update to 4.9.1
- Medium4.3Missing Authorization
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium4.38.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
8.5 – 8.9.4Update to 8.9.5
- Medium5.36.17.4.1 - Unauthenticated Information Exposure
The Events Calendar
4.5 – 6.17.4.1Update to 6.17.5
- Medium5.3Unauthenticated Information Exposure
WPC Smart Compare for WooCommerce
≤6.6.0Update to 6.6.1
- High7.5Unauthenticated SQL Injection
JetFormBuilder Stripe Gateway
≤1.0.0Update to 1.1.0
- Medium5.3Unauthenticated Information Exposure
NP Quote Request for WooCommerce
≤2.4.15Update to 2.4.16
- Medium4.3Missing Authorization
WC Fields Factory
≤4.1.10Update to 4.1.11
- High8.1Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
WP Ultimate Review
≤2.4.2Update to 2.4.3
- Medium4.35.7.2 - Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
5.3.6 – 5.7.2Update to 5.7.3
- Medium5.3Missing Authorization
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.0Update to 3.1.0
- Medium5.3Unauthenticated CAPTCHA Bypass
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.0Update to 3.1.0
- Medium5.32.0.15 - Unauthenticated Information Exposure
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
1.95 – 2.0.15Update to 2.1.0
- Medium5.3Missing Authorization
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium4.36.17.4.1 - Missing Authorization
The Events Calendar
6.15.0 – 6.17.4.1Update to 6.17.5
- Medium5.3Unauthenticated Poll Vote Limit Bypass
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1