Database
WordPress vulnerabilities listed in CISA KEV (page 1266)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Arbitrary Listing Export
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2
- Medium6.5Cross-Site Request Forgery to Stored Cross-Site Scripting
Content Copy Protection & Prevent Image Save
≤1.3No patch available
- High7.2Arbitrary File Upload
College publisher Import
≤0.1No patch available
- High8.8Cross-Site Request Forgery
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11Update to 5.11.1
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.10.1Update to 5.11
- High7.2Authenticated PHP4 Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11Update to 5.11.1
- Medium6.4Authenticated (Subscriber+) Cross-Site Scripting
Contact Form Check Tester
≤1.0.2No patch available
- High8.8Arbitrary File Upload
classyfrieds
≤3.8No patch available
- High7.2Cross-Site Request Forgery
Event Banner
≤1.3No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Larsens Calender
≤1.2No patch available
- High8.8Cross-Site Request Forgery
Media File Renamer: Rename Images & Files for SEO (AI-Powered)
≤5.2.5Update to 5.2.6
- Critical9.8Arbitrary File Upload
Imagements
≤1.2.5No patch available
- Medium5.4Insecure Default to Unauthorized Page Editing
WP Page Builder
<1.2.4Update to 1.2.4
- High7.4Multiple Stored Cross-Site scripting
WP Page Builder
<1.2.4Update to 1.2.4
- Medium6.4Job Board WordPress Theme <= 2.0.31 - Stored Cross-Site Scripting
Workscout Core
<1.3.4Update to 1.3.4
- Medium6.1Reflected Cross-Site Scripting
Stop Spammers Classic
<2021.9Update to 2021.9
- Medium6.1Reflected Cross-Site Scripting
OpenID Connect Generic Client
3.8.0 – <3.8.2Update to 3.8.2
- Medium6.5Arbitrary License Options Update
WPBakery Page Builder Clipboard
<4.5.8Update to 4.5.8
- Medium5.5Authenticated Local File Inclusion
Tutor LMS – eLearning and online course solution
≤1.8.7Update to 1.8.8
- Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
<3.7.0.1Update to 3.7.0.1
- Medium6.4Stored Cross-Site Scripting
WPBakery Page Builder Clipboard
<4.5.6Update to 4.5.6
- Critical9.8Arbitrary File Upload
Business Hours Pro WordPress Plugin
≤5.5.0No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
Erident Custom Login Page & Dashboard
≤3.5.8Update to 3.5.9
- Medium6.1Reflected Cross-Site Scripting
Realteo
≤1.2.3Update to 1.2.4
- Critical9.9Privilege Escalation
Controlled Admin Access
<1.5.6Update to 1.5.6
- Medium6.1Reflected Cross-Site Scripting
Cooked Pro
<1.7.5.6Update to 1.7.5.6
- Medium6.1Reflected Cross-Site Scripting
Advanced Booking Calendar
<1.6.8Update to 1.6.8
- Medium6.1Reflected Cross Site Scripting
Ivory Search – WordPress Search Plugin
≤4.6Update to 4.6.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Login Security and History
≤1.0No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting
Virtual Robots.txt
≤1.9Update to 1.10