Database
WordPress vulnerabilities listed in CISA KEV (page 1253)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1WP Fusion Lite <= 3.37.18 – Cross-Site Request Forgery to Data Deletion
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.37.18Update to 3.37.30
- High8.8Authenticated SQL Injection
WP Simple Booking Calendar
≤2.0.6Update to 2.0.7
- Medium6.1Cross-Site Scripting
ReFlex Gallery » WordPress Photo Gallery
<1.4.3Update to 1.4.3
- High8.8Authenticated SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.60Update to 6.60
- High8.8SQL Injection
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤2.4.1Update to 2.4.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Highlight Sitewide Notice, Text, Button Menu
<0.9.3Update to 0.9.3
- High7.5Missing Capabilities Check to Information Disclosure
Welcart e-Commerce
<2.2.8Update to 2.2.8
- Medium5.4Authenticated Stored Cross-Site Scripting
Free Cookie Notice & Consent Banner for Privacy Compliance (GDPR, CCPA, DSGVO and others)
<1.7.2Update to 1.7.2
- Medium6.1WP Fusion Lite <= 3.37.18 – Reflected Cross-Site Scripting
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.37.18Update to 3.37.30
- Medium4.3Missing Capabilities Check to Information Disclosure
Welcart e-Commerce
<2.2.8Update to 2.2.8
- Medium5.5Stored Cross-Site Scripting
WP Mapa Politico España
<3.7.0Update to 3.7.0
- High8.8SQL Injection
Availability Calendar
<1.2.1Update to 1.2.1
- Medium5.5Stored Cross-Site Scripting
Availability Calendar
≤1.2.1Update to 1.2.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Business Hours Indicator
<2.3.5Update to 2.3.5
- Medium6.1Reflected Cross-Site Scripting via ga_action parameter
ShareThis Dashboard for Google Analytics
<2.5.2Update to 2.5.2
- Medium6.1Reflected Cross Site Scripting
Email Encoder – Protect Email Addresses and Phone Numbers
≤2.1.1Update to 2.1.2
- Medium5.5Authenticated Stored Cross-Site Scripting
Sitewide Notice WP
<2.3Update to 2.3
- High7.5PHP Object Injection
Bold Page Builder
≤3.1.5Update to 3.1.6
- Medium6.1Cross-Site Scripting
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
<3.4.7Update to 3.4.7
- High8.8Cross-Site Request Forgery
Youtube Feeder
≤2.0.1No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WP Dialog
≤1.2.5.5No patch available
- High8.8Nifty Newsletters <= 4.0.23 – Cross-Site Request Forgery to Stored Cross-Site Scripting
Nifty Newsletters (Formerly Sola Newsletters)
≤4.0.23No patch available
- Medium5.5Stored Cross-Site Scripting
youForms for WordPress – Creating Forms for CopeCart
≤1.0.5Update to 1.0.6
- Medium6.4Authenticated Stored Cross-Site Scripting
有赏 You Shang
≤1.0.1No patch available
- High8.8SQL Injection
ZhuiGe Official Website Mini Program
<1.1.1Update to 1.1.1
- Medium6.5Cross-Site Scripting
Download Manager
≤3.1.24Update to 3.1.25
- High7.5Authenticated File Upload
Download Manager
≤3.1.24Update to 3.1.25
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Alojapro Booking Engine
≤1.1.15Update to 1.1.16
- Medium5.5Stored Cross-Site Scripting
Splash Header
<1.20.8Update to 1.20.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP
<2.0.1Update to 2.0.1