Database
WordPress vulnerabilities listed in CISA KEV (page 1249)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Admin+ Stored Cross-Site Scripting
Modern Events Calendar Lite
≤5.22.1Update to 5.22.2
- Critical9.8Multiple Unauthenticated SQL Injections
Support Board
≤3.3.3Update to 3.3.4
- High8.1SQL Injection
Meow Gallery
<4.1.9Update to 4.1.9
- Medium6.4Authenticated (admin+) Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.1.1.2Update to 2.1.1.3
- Medium6.5Contributor+ Arbitrary File Download
Simple Download Monitor
<3.9.5Update to 3.9.5
- Medium6.1Easy Social Icons <= 3.0.8 – Reflected Cross-Site Scripting
Easy Social Icons
≤3.0.8Update to 3.0.9
- Medium6.4Cross-Site Scripting
Zoho CRM Lead Magnet
≤1.7.2.4Update to 1.7.2.9
- Medium5.3Missing Authorization to Sensitive Information Disclosure
Redux Framework
≤4.2.11Update to 4.2.13
- High7.1Incorrect Authorization Leading to Arbitrary Plugin Installation and Post Deletion
Redux Framework
≤4.2.12Update to 4.2.13
- Medium5.3Unauthenticated Settings Import/Export
WooCommerce Dynamic Pricing and Discounts
<2.4.2Update to 2.4.2
- Medium6.1Reflected Cross-Site Scripting
underConstruction
≤1.18Update to 1.19
- Medium6.5Stored Cross-Site Scripting
WooCommerce Dynamic Pricing and Discounts
<2.4.2Update to 2.4.2
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA
<2.1.2Update to 2.1.2
- High7.5WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversal
ZoomSounds - WordPress Wave Audio Player with Playlist
≤6.45Update to 6.50
- Medium6.5Authenticated (Subscriber+) Limited Arbitrary Option Update
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.5.1Update to 4.5.2
- Medium5.4Authenticated Stored Cross-Site Scripting
CoolClock
<4.3.5Update to 4.3.5
- Medium4.8Authenticated Stored Cross-Site Scripting
TranslatePress – Translate Multilingual sites with AI Translation
<2.0.9Update to 2.0.9
- Medium4.3Missing Authorization
Countdown Block
<1.1.2Update to 1.1.2
- Medium5.5Duplicate Page <= 4.4.1 Authenticated (Admin+) Stored Cross-Site Scripting
Duplicate Page
≤4.4.1Update to 4.4.2
- Medium5.4Gutenberg Blocks for Post Grid <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Post Grid Gutenberg Blocks – PostX
<2.4.10Update to 2.4.10
- Medium5.4Gutenberg Blocks for Post Grid <= 2.4.9 - Stored Cross-Site Scripting
Post Grid Gutenberg Blocks – PostX
<2.4.10Update to 2.4.10
- Medium4.3Private Content Disclosure
Post Grid Gutenberg Blocks – PostX
≤2.4.9Update to 2.4.10
- Medium5.4Stored Cross-Site Scripting
WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters
<1.2.3Update to 1.2.3
- Medium4.7Open Redirect
Nested Pages
≤3.1.15Update to 3.1.16
- Medium6.4Authenticated (Author) Stored Cross-Site Scripting
Real Media Library: Media Library Folder & File Manager
≤4.14.1Update to 4.14.2
- High8.1Cross-Site Request Forgery to Arbitrary Post Deletion and Modification
Nested Pages
≤3.1.15Update to 3.1.16
- Medium6.4Contributor+ Cross-Site Scripting
MX Time Zone Clocks
<3.4.1Update to 3.4.1
- Critical9.8Authentication Bypass
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.4.3Update to 5.4.4
- Critical9.8Unauthenticated SQL Injection
Podlove Podcast Publisher
<3.5.6Update to 3.5.6
- Medium5.4Authenticated Stored Cross-Site Scripting
Recipe Card Blocks Lite
<2.8.3Update to 2.8.3