Database
WordPress vulnerabilities listed in CISA KEV (page 121)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
≤5.4.6Update to 5.4.7
- Medium4.3Authenticated (Hydra Host+) Insecure Direct Object Reference
Hydra Booking — Appointment Scheduling & Booking Calendar
≤1.2.1Update to 1.2.2
- High7.5Unauthenticated SQL Injection
VikRentItems Flexible Rental Management System
≤1.2.3Update to 1.2.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Business Name Generator
≤1.3No patch available
- Medium5.3Missing Authorization
Secure Custom Fields
≤6.9.3Update to 6.9.4
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.9.6Update to 7.9.7
- Medium5.3Unauthenticated Payment Bypass
SUMIT Payment Gateway for WooCommerce
≤3.0.0Update to 4.0.0
- Medium5.3Unauthenticated Email Verification Bypass
FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login
≤2.1.2Update to 3.0.0
- Medium5.3Missing Authorization
Easy Invoice – Invoice Generator, PDF Quotes & Payments
≤2.3.8Update to 2.4.0
- Medium4.3Missing Authorization
Simple Membership
≤4.8.2Update to 4.8.3
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Cooked – Recipe Management
≤1.16.0Update to 1.16.1
- Medium5.3Missing Authorization
Booking Calendar
≤11.7Update to 11.8
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.2.7Update to 5.2.8
- Medium4.3Cross-Site Request Forgery
Issues and Series for Newspapers, Magazines, Publishers, Writers
≤3.1.3Update to 3.1.4
- Medium4.3Cross-Site Request Forgery
Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility
≤7.1.0.43Update to 7.1.0.44
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Geo Mashup
≤1.13.21Update to 1.13.22
- Medium5.3Missing Authorization
BerqWP – WordPress Performance Plugin
≤4.1.15Update to 4.1.16
- High8.1Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
Paid Downloads
≤3.15No patch available
- Critical9.8Unauthenticated Arbitrary File Upload via Chunked File Upload
Multi Uploader for Gravity Forms
≤1.1.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.44Update to 1.8.45
- Medium5.3Unauthenticated Insufficient Credential Protection via Authorization Basic Header
All-in-One WP Migration and Backup
≤7.110Update to 7.111
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Mega Menu
≤1.4.2No patch available
- Medium5.3Unauthenticated Payment Bypass
UpsellWP – Upsell and Related Products Offers for WooCommerce
≤2.2.9Update to 2.2.10
- Medium4.3Missing Authorization
Blog2Social: Social Media Auto Post & Scheduler
≤9.0.0Update to 9.1.0
- Medium5.3Unauthenticated Unbounded Option Growth
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.2Update to 9.8.3
- Medium5.3Unauthenticated Account Registration
Clean Login
≤1.18Update to 1.19
- High7.2Unauthenticated Server-Side Request Forgery
Generate PDF using Contact Form 7
≤4.2.1Update to 4.2.2
- Medium5.3Unauthenticated CAPTCHA Bypass
Clean Login
≤1.18Update to 1.19
- Medium4.3Insecure Direct Object Reference
Blog2Social: Social Media Auto Post & Scheduler
≤9.0.0Update to 9.1.0
- Medium4.3Missing Authorization
Bookit — Booking & Appointment Calendar
≤2.6.0.4Update to 2.6.0.5