Database
WordPress vulnerabilities listed in CISA KEV (page 1258)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Stored Cross-Site Scripting
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.0.7.1Update to 3.0.7.2
- Low2.7Server-Side Request Forgery
RSVPMaker
<8.7.3Update to 8.7.4
- High8.8SQL Injection
Popup Like box – Page Plugin
≤3.5.2Update to 3.5.3
- High8.8Blind SQL Injection
Portfolio Responsive Gallery
≤1.1.7Update to 1.1.8
- High7.2SQL Injection
Quiz Maker by AYS
<6.2.0.9Update to 6.2.0.9
- Medium5.4Stored Cross-Site Scripting
WP Offload SES Lite
≤1.4.4Update to 1.4.5
- High7.2SQL Injection
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
<3.2.1Update to 3.2.1
- High7.2Responsive Image Gallery <= 4.4.3 - Authenticated Blind SQL Injections
Photo Gallery by Ays – Responsive Image Gallery
<4.4.4Update to 4.4.4
- High8.8Blind SQL Injection
FAQ Builder AYS
≤1.3.5Update to 1.3.6
- High8.1Authorization Bypass
Workreap - Freelance Marketplace and Directory WordPress Theme
<2.2.2Update to 2.2.2
- High7.2SQL Injection
Secure Copy Content Protection and Content Locking
<2.6.7Update to 2.6.7
- High8.8SQL Injection
Image Slider by Ays- Responsive Slider and Carousel
<2.5.0Update to 2.5.0
- High8.8Authenticated SQL Injection
Handsome Testimonials & Reviews
<2.1.1Update to 2.1.1
- High8.8Authenticated SQL Injection
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
<2.3.4Update to 2.3.4
- High8.8Authenticated SQL Injection
Survey Maker by AYS
<1.5.6Update to 1.5.6
- Critical9.83.1.3 - Arbitrary File Upload
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
3.0.0 – 3.1.3Update to 3.1.4
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
3.0.0 – 3.1.3Update to 3.1.4
- Medium6.4Contributor+ Stored Cross-Site Scripting
YouTube Embed, Playlist and Popup by WpDevArt
<2.3.9Update to 2.3.9
- Medium6.4Authenticated Stored Cross-Site Scripting
Steam Group Viewer
≤2.1No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Event Geek
≤2.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting via extension
W3 Total Cache
<2.1.4Update to 2.1.4
- Critical9.8Server-Side Request Forgery & Remote File Inclusion
Onair2: Radio Station WordPress Theme With Non-Stop Music Player
<3.9.9.2Update to 3.9.9.2
- Medium6.4Stored Cross-Site Scripting
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.0.6Update to 1.0.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
DrawBlog
≤0.90No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Migrate Users
≤1.0.1No patch available
- High7.2Reflected Cross-Site Scripting via extension
W3 Total Cache
0.5 – 2.1.4Update to 2.1.5
- Medium5.5Authenticated Stored Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.1.8Update to 3.1.8
- Medium6.1Reflected Cross-Site Scripting
Post Grid
≤2.1.7Update to 2.1.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Any Hostname
≤1.0.6No patch available
- Medium6.1Reflected Cross-site Scripting via id Parameter
Awesome Weather Widget
≤3.0.2No patch available