Database
WordPress vulnerabilities listed in CISA KEV (page 1237)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via ppress_cc_data Parameter
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.2.3Update to 3.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Shiny Buttons – CSS3 Button Generator for WordPress
≤1.1.0No patch available
- Medium6.1Cross-Site Scripting
Activity Log for WordPress
<1.0.21Update to 1.0.21
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Nofollow
≤1.4.8No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Flex Local Fonts
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery
Wp Limits
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Auto Featured Image (Auto Post Thumbnail)
≤3.9.2Update to 3.9.3
- Medium4.8Admin+ Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.2Update to 2.6.3
- Critical9.8Unauthenticated Blind SQL Injection via time Parameter
Modern Events Calendar Lite
<6.1.5Update to 6.1.5
- Medium5.5Stored Cross-Site Scripting
Inspirational Quote Rotator
≤1.0.0No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤8.4.2Update to 8.4.3
- Medium6.1Reflected Cross-Site Scripting
Database for Contact Form 7, WPforms, Elementor forms
≤1.2.3Update to 1.2.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤6.1.2No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Database Addon for Contact Form 7 – CFDB7
≤1.2.6.1Update to 1.2.6.2
- High8.8Authenticated Arbitrary File Upload
WP Popular Posts
≤5.3.2Update to 5.3.3
- Medium6.5Cross-Site Request Forgery
Database Addon for Contact Form 7 – CFDB7
≤1.2.5.9Update to 1.2.6.1
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Contact Form Email
≤1.3.24Update to 1.3.25
- Medium6.5Unauthorised Vote Export to Email & IP Addresses Disclosure
Like Button Rating ♥ LikeBtn
≤2.6.37Update to 2.6.38
- Medium4.8Admin+ Stored Cross-Site Scripting
Caldera Forms – More Than Contact Forms
<1.9.5Update to 1.9.5
- High8.8Cross-Site Request Forgery
WP Reset
5.00 – 5.98Update to 5.99
- High8.8Missing Authorization to Database Reset
WP Reset
5.00 – 5.98Update to 5.99
- Medium5.4Authenticated Stored Cross-Site Scripting
Meks Easy Photo Feed Widget
<1.2.4Update to 1.2.4
- Medium6.1Reflected Cross-Site Scripting
Booking Package
<1.5.11Update to 1.5.11
- Medium5.5Arbitrary File Deletion
Error Log Viewer by BestWebSoft
≤1.1.1Update to 1.1.2
- Critical9.8Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.1.4Update to 4.1.4
- Medium6.5Arbitrary Post Metadata Access
Get Custom Field Values
<4.0Update to 4.0
- Medium6.4Contributor+ Stored Cross-Site Scripting
Get Custom Field Values
<4.0.1Update to 4.0.1
- Critical9.8Unauthenticated SQL Injection
Registrations for the Events Calendar – Event Registration Plugin
<2.7.6Update to 2.7.6
- Medium5.4Staff Member Stored Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤20.3Update to 20.3.1
- Medium6.1Reflected Cross-Site Scripting
FOX – Currency Switcher Professional for WooCommerce
≤1.3.7Update to 1.3.7.1