Database
WordPress vulnerabilities listed in CISA KEV (page 1236)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Blog2Social: Social Media Auto Post & Scheduler
≤6.8.6Update to 6.8.7
- High7.2File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
Ninja Forms - File Uploads
≤3.3.12Update to 3.3.13
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Easy Registration Forms
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Preview E-mails for WooCommerce
≤1.6.8Update to 2.0.0
- Medium6.4Reflected Cross-Site Scripting
Child Theme Generator
≤2.2.7No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Backup Migration
≤1.1.5Update to 1.1.6
- Critical9.8Unauthenticated Arbitrary File Upload
Wordpress Plugin Smart Product Review
≤1.0.4Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting
SportsPress – Sports Club & League Manager
≤2.7.8Update to 2.7.9
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.0.6.1Update to 7.0.6.2
- High8.8Cross-Site Request Forgery
Push Notifications for WordPress (Lite)
<6.0.1Update to 6.0.1
- Medium6.4Cross-Site Scripting
Mortgage Calculator
<1.5.17Update to 1.5.17
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Nofollow
≤1.4.8No patch available
- Critical9.8Unauthenticated SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.67Update to 6.67
- Medium4.8Authenticated (Admin+) Cross-Site Scripting
Security Audit
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Shiny Buttons – CSS3 Button Generator for WordPress
≤1.1.0No patch available
- Medium4.3Improper Access Control
User meta shortcodes
≤0.5No patch available
- Medium4.3Plugin's Settings Update via Cross-Site Request Forgery
WP Admin Logo Changer
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Quotes Collection
≤2.5.2No patch available
- Medium5.4Stored Cross-Site Scripting
Display Post Metadata
<1.5.0Update to 1.5.0
- Medium4.3Missing Authorization
Page/Post Content Shortcode
≤1.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Flex Local Fonts
≤1.0.0No patch available
- High8.5Missing Authorization
Contact Form Advanced Database
≤1.0.8No patch available
- High8.8SQL Injection
Mediamatic – Media Library Folders
≤2.8.0Update to 2.8.1
- High7.2Admin+ SQL Injection
SEO Booster
≤3.7Update to 3.8
- Medium4.3Authenticated (Contributor+) Arbitrary Posts/Pages Access
Improved Include Page
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Auto Featured Image (Auto Post Thumbnail)
≤3.9.2Update to 3.9.3
- Medium6.1Reflected Cross-Site Scripting via current_month_divider parameter
Modern Events Calendar Lite
≤6.1.0Update to 6.1.5
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.1Update to 2.6.2
- Medium4.8Admin+ Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.2Update to 2.6.3
- Critical9.8Unauthenticated Blind SQL Injection via time Parameter
Modern Events Calendar Lite
<6.1.5Update to 6.1.5