Database
WordPress vulnerabilities listed in CISA KEV (page 128)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated SQL Injection via 'compare' Parameter
rtMedia for WordPress, BuddyPress and bbPress
≤4.7.11Update to 4.7.12
- Medium6.5Authenticated (Subscriber+) SQL Injection via Parameter Name
Smart Marketing SMS and Newsletters Forms
≤5.1.24Update to 5.1.25
- Critical9.8Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
The Events Calendar
≤6.17.3Update to 6.17.3.1
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
The Events Calendar
≤6.17.4Update to 6.17.4.1
- Medium4.3Missing Authorization
Simple Membership
<4.7.8Update to 4.7.8
- Medium5.33.0.17 - Missing Authorization
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
3.0.10 – 3.0.17Update to 3.0.18
- Medium5.3Unauthenticated Two-Factor Authentication Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.0Update to 9.8.1
- Medium4.3Authenticated (Subscriber+) Payment Bypass to Unpaid Ad Placement Acquisition
Quads Ads Manager for Google AdSense
3.0.4 – 3.0.4Update to 3.0.5
- Medium4.3Authenticated (Subscriber+) Information Exposure
SSL Zen — SSL Certificate Installer & HTTPS Redirects
<4.7.40Update to 4.7.40
- Medium5.3Missing Authorization
YITH WooCommerce Wishlist
<4.18.1Update to 4.18.1
- Medium5.30.9.3 - Unauthenticated Payment Bypass
Payment Gateway PayPay for WooCommerce
0.5 – 0.9.3No patch available
- Medium5.37.6.2 - Unauthenticated Insecure Direct Object Reference
Nexi XPay Build
7.6.1 – 7.6.2No patch available
- High8.1Unauthenticated PHP Object Injection
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.0Update to 3.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Simple Payment
≤2.5.4Update to 2.5.6
- Medium5.3Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1066Update to 1.7.1067
- Medium5.3Unauthenticated Information Exposure
bbPress
≤2.6.14Update to 2.6.15
- High8.18.2.2 - Unauthenticated PHP Object Injection
Site Reviews
7.2.2 – 8.2.2Update to 8.3.0
- Medium6.35.0.15 - Authenticated (Custom Role+) Privilege Escalation
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
5.0.0 – 5.0.15Update to 5.0.16
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
≤4.10.0Update to 4.10.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
≤5.9.9Update to 5.9.10
- Medium4.3Missing Authorization
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.2.2Update to 3.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
Booking for Appointments and Events Calendar – Amelia
≤2.4.9Update to 2.4.10
- Medium5.3Missing Authorization
MDJM Event Management
<1.7.8.5Update to 1.7.8.5
- Medium4.34.0.5 - Authenticated (Contributor+) Insecure Direct Object Reference
Visualizer – Tables & Charts Manager with Built-in AI Generator
4.0.0 – 4.0.5Update to 4.0.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Gato GraphQL
≤19.2.3Update to 19.2.4
- Medium5.3Missing Authorization
zipMoney(Zip Co) Payments Plugin for WooCommerce
<2.4.0Update to 2.4.0
- Medium4.35.7.4 - Missing Authorization
BackWPup – WordPress Backup & Restore Plugin
5.2.2 – 5.7.4Update to 5.7.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Featured Image with URL
<1.0.6Update to 1.0.6
- Medium6.42.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
AI Builder – Generate pages, blocks, images & translate with AI
2.4.1 – 2.7.7Update to 2.7.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Gutenverse News – News Blocks for Blog & Magazine Sites
<3.3.3Update to 3.3.3