Database
WordPress vulnerabilities listed in CISA KEV (page 123)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.7Authenticated (Admin+) Privilege Escalation
All-in-One WP Migration and Backup
≤7.110Update to 7.111
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.1Update to 28.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
Bold Page Builder
≤5.9.6Update to 5.9.7
- Medium6.1Reflected Cross-Site Scripting via 'icn' Parameter
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.15.22Update to 2.15.23
- High7.2Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request
WP-Lister Lite for eBay
≤3.8.9Update to 3.8.10
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
Advanced Popups
≤1.2.3Update to 1.2.4
- Medium5.3Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.16Update to 2.8.17
- Medium6.5Authenticated (Custom+) SQL Injection via 'order_by' Parameter
WP Directory Kit
≤1.5.4Update to 1.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
Getwid – Gutenberg Blocks
2.1.3 – 2.1.3Update to 2.2.0
- High8.8Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤32.0.1Update to 33.0.0
- Critical9.8Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
TrueBooker – Appointment Booking and Scheduler System
≤1.2.3Update to 1.2.4
- Critical9.8Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.2Update to 3.6.2.1
- Critical9.8Unauthenticated Remote Code Execution
Migratico Lite
≤2.6.8Update to 2.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
MotoPress Hotel Booking
≤6.2.4Update to 6.3.0
- Critical9.8Authentication Bypass
The Pressengine
≤1.0No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Motors – Car Dealership & Classified Listings Plugin
≤1.4.120Update to 1.4.121
- Medium5.3Missing Authorization
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.1.8Update to 3.1.9
- Medium5.3Missing Authorization
Autopay
≤5.0.0Update to 5.0.1
- Medium4.3Missing Authorization
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
≤5.1.0Update to 5.1.1
- Medium4.3Missing Authorization
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.2Update to 2.1.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.3.7Update to 5.3.8
- High7.5Unauthenticated Arbitrary File Donwload
design-scuole-wordpress-theme
2.6.0 – 2.18.1No patch available
- Medium6.1Reflected Cross-Site Scripting
design-scuole-wordpress-theme
1.0 – 2.18.2No patch available
- High7.21.6 - Unauthenticated Stored Cross-Site Scripting
To Do List Member
1.4 – 1.6No patch available
- Critical9.8Authentication Bypass
Login with QR
≤1.0.0No patch available
- Critical9.8Authentication Bypass
Private Feed Key
≤0.1No patch available
- Medium5.34.4.6 - Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
4.4.3 – 4.4.6Update to 4.4.7
- Medium6.1Reflected Cross-Site Scripting
Dictionary
≤1.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
EWWW Image Optimizer
≤8.7.6Update to 8.7.7
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
PuppyFW
≤0.4.4No patch available