Database
WordPress vulnerabilities listed in CISA KEV (page 1234)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.6.1Update to 2.6.2
- Medium4.8Reflected Cross-Site Scripting via tab and section parameter
PDF Invoices & Packing Slips for WooCommerce
<2.10.5Update to 2.10.5
- High8.8SQL Injection
WPcalc – create any online calculators
≤2.1No patch available
- High7.5Denial of Service
Stars Rating
<3.5.1Update to 3.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Site Reviews
≤5.17.2Update to 5.17.3
- High8.8Subscriber+ SQL Injection
Events Made Easy
≤2.2.35Update to 2.2.36
- High7.5Unauthenticated Arbitrary Tab Modification
Tab – Accordion, FAQ
<1.3.2Update to 1.3.2
- High8.8Cross-Site Request Forgery
Button Generator – Easily Create Custom Buttons with Icons and Analytics
≤2.3.2Update to 2.3.3
- High8.8Cross-Site Request Forgery to Remote Code Execution
Modal Window – create popup modal window
<5.2.2Update to 5.2.2
- High8.8Remote File Inclusion leading to Remote Code Execution via Cross-Site Request Forgery
WP Coder – Insert & Manage Code Snippets
≤2.5.1Update to 2.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Survey Maker by AYS
≤2.0.6Update to 2.0.7
- Medium5.4Subscriber+ Category Add Leading to Stored Cross-Site Scripting
Modern Events Calendar Lite
≤6.1.6Update to 6.2.0
- Medium5.4Cross-Site Scripting
Customize Login Image
≤3.4Update to 3.5
- High7.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.4Cross-Site Scripting
Post Duplicator
<2.24Update to 2.24
- Medium4.3Missing Authorization on Option Changes
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.5Missing Authorization to Information Disclosure
Advanced Custom Fields (ACF®)
<5.11Update to 5.11
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Variation Swatches for WooCommerce
≤2.1.1Update to 2.1.2
- Medium4.9Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.11Update to 4.5.12
- Medium5.5Editor+ Stored Cross-Site Scripting
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
≤5.3.0Update to 5.3.1
- Medium6.1Reflected Cross-Site Scripting in General Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting in PDF Invoicing Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting in Product XML Feeds Module
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<5.4.9Update to 5.4.9
- Medium4.9Admin+ Arbitrary Folder Deletion via Path Traversal
CAOS | Host Google Analytics Locally
≤4.1.8Update to 4.1.9
- Medium6.1Reflected Cross-Site Scripting via qc_res
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- Medium6.5Authorization Bypass
LiteSpeed Cache
1.0.15 – 4.4.3Update to 4.4.4
- High8.8Cross-Site Request Forgery
Contact Form With Captcha
≤1.6.7Update to 1.6.8
- Medium6.1Reflected Cross-Site Scripting
MOLIE – Instructure Canvas Linking tool
≤0.5No patch available
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Typebot
<1.4.3Update to 1.4.3
- Medium6.4Cross-Site Scripting
Download Manager
<3.2.22Update to 3.2.22