Database
WordPress vulnerabilities listed in CISA KEV (page 1277)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.3Unauthenticated Stored Cross-Site Scripting
TC Custom JavaScript
<1.2.2Update to 1.2.2
- Medium6.5KEVPoCjQuery Manager for WordPress <= 1.10.4 & jQuery Migrate Helper <= 1.4.1- Running Vulnerable Dependency
Enable jQuery Migrate Helper
≤1.4.1No patch available
- Medium6.1Reflected Cross-Site Scripting
GreenMart – Organic & Food WooCommerce WordPress Theme
<2.4.3Update to 2.4.3
- Medium4.9Authenticated SQL Injection
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.1Update to 4.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<3.6.2Update to 3.6.2
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
JetBackup – Backup, Restore & Migrate
≤1.3.9Update to 1.4.0
- High8.8Cross-Site Request Forgery
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.1Update to 4.5.1
- High8.8Cross-Site Request Forgery
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<3.1.4Update to 3.1.4
- High7.51.04 - Unauthenticated SQL Injection
SRS Simple Hits Counter
1.0.3 – 1.0.4Update to 1.1.0
- High7.2Stored Cross-Site Scripting
Knight Lab Timeline
<3.7.0Update to 3.7.0
- Medium5.5Stored Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
<2.9.4Update to 2.9.4
- Critical9.8Arbitrary File Upload
Adning Advertising
≤1.5.5Update to 1.5.6
- Medium6.4Authenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
<2.9.14Update to 2.9.14
- Medium6.5Unauthenticated Arbitrary File Deletion via Path Traversal
Adning Advertising
≤1.5.5Update to 1.5.6
- High8.8Missing Authorization
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.50Update to 2.51
- Medium5.4Multiple Authenticated Stored Cross-Site Scripting
Testimonials Widget
≤3.5.1Update to 4.0.1
- High7.1Reflected Cross-Site Scripting
CareerUp - Job Board WordPress Theme
<2.3.1Update to 2.3.1
- Critical9.8SQL Injection
Payment Form for PayPal Pro
<1.1.65Update to 1.1.65
- High8.8Cross-Site Request Forgery
Clean Login
≤1.10.3Update to 1.10.4
- High8.8Insecure Direct Object Reference
Advanced Forms for ACF
<1.6.9Update to 1.6.9
- Medium6.4Authenticated Stored Cross-Site Scripting
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
<5.1.2Update to 5.1.2
- Medium6.1Reflected Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.4Update to 2.9.5
- Medium6.5Arbitrary Quiz Deletion via Cross-Site Request Forgery
Wp-Pro-Quiz
≤0.37No patch available
- Medium4.3Cross-Site Request Forgery Bypass
Advanced Popups
≤1.1.1Update to 1.1.2
- Critical9.8Real Estate WordPress Theme <= 1.7 - SQL Injection
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Medium6.1Real Estate WordPress Theme < 1.8 - Cross-Site Scripting
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Medium6.4Authenticated Stored Cross-Site Scripting
Testimonial Rotator
<3.0.3No patch available
- Medium6.5All Comments Deletion via Cross-Site Request Forgery
Delete All Comments Easily
≤1.3No patch available
- High8.8Arbitrary File Upload
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4
- High8.8Authorization Bypass due to Improper Access Control
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4