Database
WordPress vulnerabilities listed in CISA KEV (page 1263)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.20Update to 2.1.20
- Medium5.5Stored Cross-Site Scripting
Autoptimize
<2.8.4Update to 2.8.4
- High7.3Missing Authorization
Product Filter for WooCommerce by WBW
≤1.4.9Update to 1.5.0
- Medium6.4Authenticated Stored Cross-Site Scripting
Hana Flv Player
≤3.1.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Product Slider, Product Grid, Product Masonry
≤1.13.21Update to 1.13.22
- Medium6.3Missing Authorization
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- Medium6.1Stored Cross-Site Scripting
Watcheezy Live chat plugin for WordPress
≤2.0Update to 3.0
- High8.8Authenticated (Contributor+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Hotjar Connecticator
≤1.1.1No patch available
- Medium6.1Tour & Travel WordPress Theme < 2.1 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.1Update to 2.1
- Medium4.8Authenticated Stored Cross-Site Scripting
WP Customer Reviews
≤3.5.5Update to 3.5.6
- Low3.8Authenticated (Admin+) Cross-Site Scripting
WP YouTube Lyte
<1.7.16Update to 1.7.16
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.10.4Update to 2.10.4
- Critical10.0Remote Code Execution
Social Sharing Plugin – Social Warfare
<3.5.3Update to 3.5.3
- Medium6.1Open Redirect
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
<7.5.0Update to 7.5.0
- Medium5.3Denial of Service
WPGraphQL
≤1.3.5Update to 1.3.6
- Medium6.5Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.1.7Update to 0.9.1.7
- Critical9.8Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection
Car Seller – Auto Classifieds Script
≤2.1.0No patch available
- High8.8Authenticated Privilege Escalation
Store Locator Plus® for WordPress
≤5.5.15Update to 5.7
- Critical9.8Tour & Travel WordPress Theme < 2.1 - SQL Injection
Goto - Tour & Travel WordPress Theme
<2.1Update to 2.1
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Store Locator Plus® for WordPress
≤5.12.3Update to 5.13.8
- Medium6.4Stored Cross-Site Scripting
Happy Addons for Elementor Pro
<1.17.0Update to 1.17.0
- Medium4.8Cross-Site Scripting
Smooth Page Scroll Up/Down Buttons
≤1.3Update to 1.4
- Medium4.8Admin+ Stored Cross-Site Scripting
Smooth Page Scroll Up/Down Buttons
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
Redirect 404 to parent
<1.3.1Update to 1.3.1
- Medium6.1Reflected Cross-Site Scripting
Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
<1.3.2Update to 1.3.2
- Medium5.5Admin+ Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.30Update to 1.31
- Medium5.3Arbitrary Options Update
Thrive Leads
<2.3.9.4Update to 2.3.9.4
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Content Copy Protection & No Right Click
<3.1.5Update to 3.1.5
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Captchinoo, admin login page protection with Google recaptcha
≤2.3Update to 2.4