VulnCrest
Search
Create account
Report an incident
Radar sectionsCISA KEV
Check my site

Database

WordPress vulnerabilities listed in CISA KEV (page 1242)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

Severity
Signals
Software

41,182 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress vulnerabilities listed in CISA KEV (page 1242)
SeverityVulnerabilityCVEInstallsPublished
High8.8SQL Injection
MAZ Loader – Preloader Builder for WordPress<1.3.3Update to 1.3.3
CVE-2021-24669—
High8.1Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction<3.7.1.6Update to 3.7.1.6
CVE-2021-24647—
Medium6.1Reflected Cross-Site Scripting
WP Header Images<2.0.1Update to 2.0.1
CVE-2021-24798—
High8.8SQL Injection
School Management System – WPSchoolPress<2.1.10Update to 2.1.10
CVE-2021-24575—
High8.8Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection
WCFM – Frontend Manager for WooCommerce≤6.5.11Update to 6.5.12
CVE-2021-24835—
Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Quiz Tool Lite≤2.3.15No patch available
CVE-2021-24701—
High8.8Cross-Site Request Forgery
WP SEO Redirect 301<2.3.2Update to 2.3.2
CVE-2021-24832—
Critical9.8Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction≤3.7.1.4Update to 3.7.1.5
CVE-2025-34077—
Medium4.8Stored Cross-Site Scripting
School Management System – WPSchoolPress<2.1.17Update to 2.1.17
CVE-2021-24664—
Medium4.8Admin+ Stored Cross-Site Scripting
Print-O-Matic≤2.0.2Update to 2.0.3
CVE-2021-24710—
Medium5.5Stored Cross-Site Scripting
Qwizcards | online quizzes and flashcards≤3.61Update to 3.62
CVE-2021-24706—
Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Storefront Footer Text≤1.0.1No patch available
CVE-2021-24607—
Medium5.3Modern Blog WordPress Theme < 3.0.4 - Authorization Bypass
Squaretype - Modern Blog WordPress Theme<3.0.4Update to 3.0.4
CVE-2021-24840—
High7.2Admin+ SQL injection
Affiliates Manager≤2.8.6Update to 2.8.7
CVE-2021-24844—
Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
Comment Engine Pro≤1.0No patch available
CVE-2021-36911—
High8.8Cross-Site Request Forgery
Chameleon CSS≤1.2No patch available
CVE-2021-24626—
Medium6.4Agent+ Stored Cross-Site Scripting
Support Board≤3.3.4Update to 3.3.5
CVE-2021-24807—
High7.2Authenticated (Admin+) SQL Injection
Post Content XMLRPC≤1.0No patch available
CVE-2021-24629—
High7.2Authenticated (Admin+) SQL Injection
Wow Forms – create any form with custom style≤3.1.3No patch available
CVE-2021-24628—
High8.8Authenticated (Author+) SQL Injection
Schreikasten≤0.14.18No patch available
CVE-2021-24630—
High7.2Authenticated (Admin+) SQL Injection
Unlimited PopUps≤4.5.3No patch available
CVE-2021-24631—
High7.2Authenticated (Admin+) SQL Injection
SpiderCatalog≤1.7.3No patch available
CVE-2021-24625—
High7.2Authenticated (Admin+) SQL Injection
G Auto-Hyperlink≤1.0.1No patch available
CVE-2021-24627—
High8.8Authenticated (Subscriber+) Arbitrary File Upload
Arrival≤1.4.2Update to 1.4.3
CVE-2021-39317—
Medium4.3Log Deletion via Cross-Site Request Forgery
Redirect 404 Error Page to Homepage or Custom Page with Logs≤1.7.8Update to 1.7.9
CVE-2021-24767—
Medium4.8Admin+ Stored Cross-Site Scripting
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel<1.3.1Update to 1.3.1
CVE-2021-24708—
High8.8Subscriber+ SQL Injection
Visitor Traffic Real Time Statistics≤3.8Update to 3.9
CVE-2021-24829—
Medium4.3Cross-Site Request Forgery
Genie WP Favicon≤0.5.2No patch available
CVE-2021-24674—
Medium4.3Author Arbitrary Media File Renaming
Phoenix Media Rename≤3.4.2Update to 3.4.4
CVE-2021-24816—
Medium4.8Admin+ Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder<5.0.07Update to 5.0.07
CVE-2021-24608—

Search VulnCrest Radar

Jump to

Are you sure?