Database
WordPress vulnerabilities listed in CISA KEV (page 124)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Remote Code Execution
wpShopGermany IT-RECHT KANZLEI
≤2.3Update to 2.4
- Medium4.32.5.3 - Authenticated (Author+) Information Exposure
Comments Import & Export
2.1.11 – 2.5.3Update to 2.5.4
- Medium5.3Missing Authorization
design-scuole-wordpress-theme
1.0 – 2.17.3No patch available
- Medium5.3Unauthenticated Information Exposure
Newsletter
≤9.3.7Update to 9.3.8
- High7.3Unauthenticated Arbitrary Account Takeover
Headless SSO Plugin for WP
≤1.7.0Update to 1.7.1
- Medium5.3Unauthenticated Payment Bypass
Robokassa payment gateway for Woocommerce
≤1.8.8Update to 1.8.9
- Medium6.1Reflected Cross-Site Scripting
Realtyna Organic IDX plugin + WPL Real Estate
≤5.4.1Update to 5.4.2
- Medium5.3Unauthenticated Payment Bypass
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.8Update to 3.0.9
- Medium4.7Open Redirect
design-scuole-wordpress-theme
1.0 – 2.17.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Dictionary
≤1.0No patch available
- Medium6.43.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
3.2.0 – 3.2.5Update to 3.2.6
- Critical9.8Unauthenticated Privilege Escalation
Choose User Role at Registration for WooCommerce
≤1.3.2Update to 1.3.3
- Medium5.3Unauthenticated Information Exposure
EduAdmin Booking
≤5.4.2Update to 6.0.0
- Medium4.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.5.0Update to 5.6.0
- High7.51.3.1 - Unauthenticated SQL Injection
Yo
1.1 – 1.3.1No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Dewa Kirim – WooCommerce Gojek / Gosend
≤1.0.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.3Update to 4.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
Job Postings
≤2.8.1Update to 2.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Visitor Traffic Real Time Statistics pro
≤11.21Update to 11.22
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Inventory Manager
≤2.5.4Update to 2.5.5
- High7.5Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.7Update to 3.7.8
- Medium5.3Unauthenticated Sensitive Information Exposure in 'id' Parameter
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
≤1.16.20Update to 1.16.21
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
≤4.15.0Update to 4.16.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets
≤4.9.5Update to 4.9.6
- Medium5.3Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter
JWT Authentication for WP REST APIs
≤4.7.0Update to 4.8.0
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Information Exposure
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
≤1.2.7Update to 1.2.8
- Medium4.3Missing Authorization
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66