Database
WordPress vulnerabilities listed in CISA KEV (page 1239)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Hidden Login Page Location Disclosure
WPS Hide Login
≤1.9.0Update to 1.9.1
- Medium6.1Reflected Cross-Site Scripting
Registrations for the Events Calendar – Event Registration Plugin
≤2.7.4Update to 2.7.5
- Medium6.4Cross-Site Scripting
About Author Box
<1.0.2Update to 1.0.2
- High8.1Missing Authorization to Database Wipe
HashThemes Demo Importer
≤1.1.1Update to 1.1.2
- Medium5.4Missing Authorisation
Bulk Datetime Change
<1.12Update to 1.12
- High7.2Authenticated SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.6.4Update to 3.6.4
- Medium4.8Admin+ Stored Cross-Site Cross-Site Scripting
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤4.1.7Update to 4.1.8
- Medium6.1eCommerce Product Catalog <= 3.0.38 Reflected Cross-Site Scripting
eCommerce Product Catalog
<3.0.39Update to 3.0.39
- Medium4.3Cross-Site Request Forgery
MAZ Loader – Preloader Builder for WordPress
≤1.4.0Update to 1.4.1
- Medium6.5Denial of Service
Reviews Plus
<1.2.14Update to 1.2.15
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Editable Table Simple Fast FrontEnd From Sql tables
≤0.1.4No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Media Tags
≤3.2.0.2No patch available
- Medium5.5Stored Cross-Site Scripting
CM Video Lessons Manager – Simplify video lessons management for better education
≤1.7.1Update to 1.7.2
- High7.2SQL Injection via orderby, order Parameters
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
<4.1.8Update to 4.1.8
- Medium4.8Cross-Site Scripting
Slideshow Gallery LITE
<1.7.4Update to 1.7.4
- Medium5.4Contributor+ Stored Cross-Site Scripting
Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions
≤2.0.3Update to 2.0.4
- Medium5.5Authenticated Stored Cross-Site Scripting
Notification – Custom Notifications and Alerts for WordPress
≤7.2.4Update to 8.0.0
- Medium4.3Cross-Site Request Forgery
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<1.2.5Update to 1.2.5
- Medium4.8Reflected Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.11.2Update to 2.11.2.1
- Medium5.5Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
Simple Job Board
≤2.9.4Update to 2.9.5
- High7.2Arbitrary File Upload
Catch Themes Demo Import
≤1.7Update to 1.8
- High8.8Object Injection
Social Sharing Plugin – Sassy Social Share
3.3.23 – 3.3.23Update to 3.3.24
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Template Kit – Import
≤1.0.13Update to 1.0.14
- High8.8Cross-Site Request Forgery
Core Tweaks WP Setup
≤4.1No patch available
- High7.2Admin+ SQL Injection via orderby parameter
Download Monitor
<4.4.5Update to 4.4.5
- Medium4.8Admin+ Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.15.4Update to 1.15.4
- Medium5.4Stored Cross-Site Scripting
BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
<1.2.6Update to 1.2.6
- Medium6.1Reflected Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤1.9.10Update to 1.9.11
- Medium5.7Cross-Site Request Forgery
Download Plugin
<1.6.1Update to 1.6.1
- High7.5Local File Inclusion
Images to WebP
≤1.8Update to 1.9