Database
WordPress vulnerabilities listed in CISA KEV (page 118)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.24.0Update to 1.25.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex
Complianz GDPR/CCPA Cookie Consent Banner
≤7.5.4Update to 7.5.5
- High8.1Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.2.2Update to 3.2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields
CSS & JavaScript Toolbox
≤12.0.6Update to 12.0.7
- Medium6.5Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.44Update to 1.8.45
- High7.5Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter
WP Multi Store Locator Pro
≤4.5.1Update to 4.5.2
- Medium6.1Reflected Cross-Site Scripting via Query-String Parameter Name
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤3.5.1Update to 3.5.2
- High8.8Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter
Mapster WP Maps
≤1.23.0Update to 1.24.0
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.3Update to 5.6.4
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
FileBird – WordPress Media Library Folders & File Manager
≤6.5.6Update to 6.5.7
- High7.5Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters
Location Manager
≤2.3.38Update to 2.3.39
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
Kubio AI Page Builder
≤2.8.4Update to 2.8.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.0Update to 9.3.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute
WP Inventory Manager
≤2.5.1Update to 2.5.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.0Update to 4.5.1
- Medium4.9Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
≤2.8.0Update to 2.8.1
- High7.5Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.2Update to 3.8.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
VK All in One Expansion Unit
≤9.118.0Update to 9.119.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
Strong Testimonials
≤3.3.8Update to 3.3.9
- Medium6.1Reflected DOM-Based Cross-Site Scripting via 's' Parameter
Qi Addons For Elementor
≤1.11Update to 1.11.1
- High7.5Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
Printcart Store – Web to Print Product Designer for WooCommerce
≤2.8.5Update to 2.8.6
- Medium6.1Reflected Cross-Site Scripting via 'nn' Parameter
Newsletter – Send awesome emails from WordPress
≤9.3.8Update to 9.3.9
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
≤1.8.6Update to 1.8.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
≤1.8.6Update to 1.8.7
- Medium6.5Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
InfiniteWP Client
≤1.13.9Update to 1.13.10
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
≤2.5.3Update to 2.5.4
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action
Filter Gallery
≤1.1.4Update to 1.1.5
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter
Filter Gallery
≤1.1.4Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
EmbedPress
≤4.6.5Update to 4.6.6