Database
WordPress vulnerabilities listed in CISA KEV (page 1241)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Author+ Stored Cross-Site Scripting via Options Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium5.4Author+ Stored Cross-Site Scripting via Preview Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium6.1Stored Cross-Site Scripting
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤15.3Update to 15.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Board Vanila Plugin
1.0 – 1.0No patch available
- Medium5.5Stored Cross-Site Scripting
WpGenius Job Listing
≤1.0.2Update to 1.0.3
- Medium5.5Stored Cross-Site Scripting
WordPress ERP, HR, CRM, and Project Management Plugin – Business Manager
≤1.4.5Update to 1.4.6
- High8.8Authenticated (Subscriber+) SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
MyBB Cross-Poster
≤1.0No patch available
- Medium5.5HAL <= 2.1.1 Authenticated Stored Cross-Site Scripting
HAL
≤2.1.1Update to 2.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
job-portal
≤0.0.1No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting
Author Bio Box
≤3.3.1Update to 3.3.2
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Manager
≤0.7.25No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
KJM Admin Notices
≤2.0.1No patch available
- High8.8Authenticated File Upload and Path Traversal
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- High7.5Insecure Password Creation
Simple JWT Login – Allows you to use JWT on REST endpoints.
<3.3.0Update to 3.3.0
- High8.8Authenticated (Admin+) SQL Injection
WP Cloudy, weather plugin
≤4.4.9No patch available
- Medium6.4Page Builder <= 2.3.11 - Stored Cross-Site Scripting
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Testimonial – WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider
<1.6.0Update to 1.6.0
- High8.8Backdoored
Frontend Post WordPress Plugin – AccessPress Anonymous Post
2.8.0 – 2.8.0Update to 2.8.1
- Medium4.3Cross-Site Request Forgery
Colorful Categories
<2.0.15Update to 2.0.15
- Medium5.4Authenticated Stored Cross-Site Scripting
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
≤2.4.13Update to 2.4.14
- High7.2Admin+ Arbitrary PHP Code Execution
Similar Posts – Best Related Posts Plugin for WordPress
≤3.1.5Update to 3.1.6
- Medium4.3Contributor+ Arbitrary Post Schedule Deletion
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
≤2.5.1Update to 2.6.0
- Medium6.5Logs Deletion via Cross-Site Request Forgery
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
<3.0.9Update to 3.0.9
- Critical9.8Unauthenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<3.7.1.6Update to 3.7.1.6
- Medium4.3wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery
Comments – wpDiscuz
<7.3.4Update to 7.3.4
- Medium5.3Modern Blog WordPress Theme < 3.0.4 - Authorization Bypass
Squaretype - Modern Blog WordPress Theme
<3.0.4Update to 3.0.4
- High8.8SQL Injection
MAZ Loader – Preloader Builder for WordPress
<1.3.3Update to 1.3.3
- High8.8Cross-Site Request Forgery
WP SEO Redirect 301
<2.3.2Update to 2.3.2