Database
WordPress vulnerabilities listed in CISA KEV (page 1235)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8SQL Injection
Rich Reviews by Starfish
<1.9.6Update to 1.9.6
- High8.8Stetic <= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting
Stetic
≤1.0.6Update to 1.0.7
- Medium4.8Authenticated Stored Cross-Site Scripting
Asgaros Forum
≤1.15.13Update to 1.15.14
- High8.8SQL Injection
MOLIE – Instructure Canvas Linking tool
≤0.5No patch available
- Medium4.8Smart Floating Action Button <= 2.5.4 - Admin+ Stored Cross-Site Scripting
Buttonizer – Floating Menus, Sticky Buttons, & Popup Builder
≤2.5.4Update to 2.5.5
- Medium5.3Sensitive Data Exposure
CorreosExpress – Shipping Management – Tags
≤2.6.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Lead Form Builder & Contact Form
≤1.6.3Update to 1.6.4
- Medium5.4Subscriber+ Stored Cross-Site Scripting
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content
<4.19.3Update to 4.19.3
- Medium6.1Reflected Cross-Site Scripting
NextScripts: Social Networks Auto-Poster
≤4.3.20Update to 4.3.21
- Medium6.1Reflected Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.0.6Update to 6.0.7
- High8.8Cross-Site Request Forgery
Browser and Operating System Finder
<1.2Update to 1.2
- High8.1Dependency Confusion
WordPress
≤5.7.5Update to 5.8
- High7.5Authorization Bypass
Hide My WP - Amazing Security Plugin for WordPress!
≤6.2.3Update to 6.2.4
- High8.6SQL Injection
Hide My WP - Amazing Security Plugin for WordPress!
≤6.2.3Update to 6.2.4
- Medium5.5Authenticated Stored Cross-Site Scripting
HTML5 Responsive FAQ
≤2.8.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Tickera – Sell Tickets & Manage Events
≤3.4.8.2Update to 3.4.8.3
- Medium6.1Reflected Cross-Site Scripting
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.6.6Update to 2.6.6
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Cybersoldier
<1.7.0Update to 1.7.0
- Medium6.1Reflected Cross-Site Scripting
WPFront User Role Editor
≤3.2.0Update to 3.2.1
- Medium6.1Reflected Cross-Site Scripting
IDPay for Contact Form 7
≤2.1.2Update to 2.3.2
- Medium6.1Reflected Cross-Site Scripting
Gwolle Guestbook
≤4.1.2Update to 4.2
- High8.8SQL Injection
Ni WooCommerce Custom Order Status
≤1.9.6Update to 1.9.7
- Medium6.1Reflected Cross-Site Scripting
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
<1.8.0Update to 1.8.0
- Medium6.5Information Disclosure
WP Guppy
<1.3Update to 1.3
- Medium4.3Unauthorised Private Post Access
Logo Carousel – Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery
≤3.4.1Update to 3.4.2
- High7.2SQL Injection
ExportFeed: List WooCommerce Products on eBay Store
≤2.0.1.0No patch available
- Medium6.1Reflected Cross-Site Scripting via message_id
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<2.0.5Update to 2.0.5
- Critical9.8WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.4.11Update to 3.4.12
- Medium6.5Stored Cross-Site Scripting
Logo Carousel
<1.7.2Update to 1.7.2
- Medium6.1Reflected Cross-Site Scripting
Blog2Social: Social Media Auto Post & Scheduler
≤6.8.6Update to 6.8.7