Database
WordPress vulnerabilities listed in CISA KEV (page 1275)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
Cool Timeline (Horizontal & Vertical Timeline)
<2.0.3Update to 2.0.3
- Medium4.3Cross-Site Request Forgery Bypass
Custom Field Template
<2.5.2Update to 2.5.2
- Medium4.3Cross-Site Request Forgery Bypass
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
<3.5.8Update to 3.5.8
- Medium4.3Cross-Site Request Forgery Bypass
Import / Export Customizer Settings
<1.0.4Update to 1.0.4
- Medium4.3Cross-Site Request Forgery Bypass
Product Catalog Simple
<1.5.13Update to 1.5.13
- Medium4.3Cross-Site Request Forgery Bypass
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
<3.0.9Update to 3.0.9
- Medium4.3Cross-Site Request Forgery Bypass
Easy Testimonials
<3.7Update to 3.7
- Medium4.3Cross-Site Request Forgery Bypass
Coupon Creator
<3.1.1Update to 3.1.1
- Medium4.3Cross-Site Request Forgery Bypass
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
<2.4.1Update to 2.4.1
- Medium4.3Cross-Site Request Forgery Bypass
Lightweight Sidebar Manager
≤1.1.4Update to 1.1.5
- Medium4.3Cross-Site Request Forgery Bypass
Menu Swapper
≤1.1.0.2Update to 1.1.1
- Medium4.3Cross-Site Request Forgery Bypass
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
<1.8.3Update to 1.8.3
- High8.8Cross-Site Request Forgery
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Critical9.8SQL Injection
DiveBook
≤1.1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
DiveBook
≤1.1.4No patch available
- Medium5.3Sensitive Information Disclosure via Directory Listing
Noo JobMonster
≤4.6.6Update to 4.6.6.1
- Medium5.3Unauthenticated Email Forgery
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.6Update to 4.5.6
- Critical9.8SQL Injection
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤7.11.17Update to 7.11.18
- Medium4.3Cross-Site Request Forgery Bypass
EWWW Image Optimizer
≤5.8.1Update to 5.9
- High7.2SQL injection
Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance
<3.0.2Update to 3.0.2
- Medium4.3Cross-Site Request Forgery
ActiveCampaign – The autonomous marketing platform
<8.0.2Update to 8.0.2
- Medium5.5Constant Contact Forms <= 1.8.7 Editor+ Stored Cross-Site Scripting
Constant Contact Forms
<1.8.8Update to 1.8.8
- Medium5.0Missing Authorization
NextScripts: Social Networks Auto-Poster
≤4.3.17Update to 4.3.18
- Critical9.8KEVPoCArbitrary File Upload/Remote Code Execution
File Manager
≤6.8Update to 6.9
- Medium5.4Stored Cross-Site Scripting
WP smart CRM & Invoices FREE
≤1.8.7No patch available
- Medium5.4Cross-Site Scripting
Recall Products
≤0.8No patch available
- Medium6.1Cross-Site Scripting
Chamber Dashboard Business Directory
<3.3.1Update to 3.3.1
- Medium6.1Reflected Cross-Site Scripting
Subscribe Sidebar plugin by Blubrry
≤1.3.1No patch available
- High8.8Authenticated SQL Injection
Recall Products
≤0.8No patch available
- High7.2SQL Injection
WordPress Poll
≤36No patch available