Database
WordPress vulnerabilities listed in CISA KEV (page 1262)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Cookie Law Bar
≤1.2.1No patch available
- Medium4.8Admin+ Stored Cross-Site Scripting
iFlyChat – WordPress Chat
<4.7.0Update to 4.7.0
- Medium6.1Cross-Site Scripting
WP Learn Manager
≤1.1.5Update to 1.1.6
- High7.5Unauthenticated SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
<13.0.8Update to 13.0.8
- High8.8Authenticated (Subscriber+) SQL Injection
Video Embed
≤1.0No patch available
- High7.2Authenticated (Editor+) SQL Injection
FlightLog
≤3.0.2No patch available
- Medium6.4Stored Cross-Site Scripting
JobSearch WP Job Board
<1.7.4Update to 1.7.4
- High7.5Insecure Direct Object Reference
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<4.21.2Update to 4.21.2
- Medium6.1Reflected Cross-Site Scripting
Car Repair Services & Auto Mechanic WordPress Theme + RTL
<4.0Update to 4.0
- Medium6.4Authenticated Stored Cross-Site Scripting
Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy
≤4.4.0Update to 4.4.0.1
- Medium4.8Authenticated Stored Cross-Site scripting via FB Pixel ID and Google Analytics ID
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
<1.6.13Update to 1.6.13
- Medium5.5Stored Cross-Site Scripting
Related Posts for WordPress
≤2.0.4Update to 2.0.5
- Medium6.4Authenticated Stored Cross-Site Scripting
WP Prayer
<1.6.2Update to 1.6.2
- Medium6.4Directory & Listing - < 1.6.0 - Cross-Site Scripting
Bello - Directory & Listing
<1.6.0Update to 1.6.0
- Medium6.5Directory & Listings With Booking - WordPress Theme < 1.6.11 - Insecure Direct Object Reference
Listeo - Directory & Listings With Booking - WordPress Theme
<1.6.11Update to 1.6.11
- Critical9.8Directory & Listing <= 1.5.9 - Unauthenticated SQL Injection
Bello - Directory & Listing
<1.6.0Update to 1.6.0
- Medium6.1Reflected Cross-Site Scripting
Mediumish
≤1.0.60No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting via backup_receipient Parameter
Database Backup for WordPress
<2.4Update to 2.4
- High7.2Authenticated Remote Code Execution
WP Super Cache
<1.7.3Update to 1.7.3
- High7.2Authenticated SQL Injection
Tradetracker-Store
<4.6.60Update to 4.6.60
- High7.2SQL Injection
Hotscot Contact Form
<1.3Update to 1.3
- High8.8Authenticated Arbitrary File Upload
External Media
<1.0.34Update to 1.0.34
- Medium6.1Stored Cross-Site Scripting
Weekly Schedule
<3.4.3Update to 3.4.3
- Medium4.8Authenticated Stored Cross-Site Scripting via Gallery Title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.67Update to 1.5.67
- Medium5.4Stored Cross-Site Scripting
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<4.21.1Update to 4.21.1
- High7.2Stored Cross-Site Scripting
ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System
≤21.0307Update to 21.0426
- Medium6.1Reflected Cross-Site Scripting
Simple Giveaways – Grow your business, email lists and traffic with contests
<2.36.1Update to 2.36.2
- High8.8Authenticated Code Injection
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<4.1.0.2Update to 4.1.0.2
- Medium4.8Stored Cross-Site Scripting
UpdraftPlus Premium
<1.6.59Update to 1.6.59
- High7.3Missing Authorization
Product Filter for WooCommerce by WBW
≤1.4.9Update to 1.5.0