Database
WordPress vulnerabilities listed in CISA KEV (page 1245)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated Stored Cross-Site Scripting
iQ Block Country
≤1.2.11Update to 1.2.12
- Medium6.4Unprotected REST-API to Email Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- Medium6.5Unprotected REST-API to Sensitive Information Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- High7.5Arbitrary User Password Reset
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.6.2Update to 2.6.3
- Medium5.4Contributor+ Stored Cross-Site Scripting
Easy Media Download
≤1.1.5Update to 1.1.7
- Medium4.8Admin+ Stored Cross-Site Scripting
Cookie Bar
≤1.8.8Update to 1.8.9
- Medium5.4Cross-Site Scripting
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
<1.4Update to 1.4
- Medium5.8Open Relay and Server-Side Request Forgery
Telefication
≤1.8.0No patch available
- High8.8Cross-Site Request Forgery
jQuery Reply to Comment
≤1.31No patch available
- Medium4.8Vimeo and YouTube Gallery < 1.1.5 - Stored Cross-Site Scripting
Video Gallery – Vimeo and YouTube Gallery
<1.1.5Update to 1.1.5
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Frontend Uploader
≤1.3.2No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Special Text Boxes
≤5.9.109Update to 5.9.110
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Responsive WordPress Slider
≤2.2.0No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
St-Daily-Tip
≤4.7No patch available
- High7.5Unauthenticated Arbitrary Post Deletion
WP DSGVO Tools (GDPR)
≤3.1.23Update to 3.1.24
- Medium4.8Stored Cross-Site Scripting
Request a Quote – Quote Forms for Any WordPress Site
<2.3.5Update to 2.3.5
- High7.2Authenticated (Admin+) SQL Injection
Game Server Status
≤1.0No patch available
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
WP HTML Author Bio
≤1.2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.6.0Update to 2.6.1
- Medium6.1Reflected Cross-Site Scripting
GamePress – The Game Database Plugin
≤1.1.0No patch available
- Medium6.5Cross-Site Request Forgery to Cross-Site Scripting
Wp Cookie Choice
≤1.1.0No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.3Update to 4.1.3.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
微信打赏（Wechat Reward）
≤1.7No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Sociable
≤4.3.4.1No patch available
- Medium5.4Cross-Site Scripting
StreamCast – bring live radio to your site with a sleek player
<2.1.1Update to 2.1.1
- Medium5.5Admin+ Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
<1.9.9Update to 1.9.9
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Polo Video Gallery – Best wordpress video gallery plugin
≤1.2No patch available
- Medium5.4Cross-Site Scripting
PDF Viewer Block for Gutenberg
<1.0.1Update to 1.0.1
- Medium5.4Missing Authorization
Catch Themes Demo Import
<1.6Update to 1.6
- Medium6.5Cross-Site Request Forgery
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7