Database
WordPress vulnerabilities listed in CISA KEV (page 1280)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8SQL Injection
WordPress WP-Advanced-Search
≤3.3.6Update to 3.3.7
- Medium4.3Redirect Security Bypass
Quick Page/Post Redirect Plugin
≤5.1.9Update to 5.2.0
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Real-Time Find and Replace
≤3.9Update to 4.0.2
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
Avada | Website Builder For WordPress & WooCommerce
<6.2.3Update to 6.2.3
- Medium6.1Unauthenticated Stored Cross-Site Scripting
WP GDPR
≤2.1.1No patch available
- Medium5.3Information Disclosure
Advanced Woo Search – Product Search for WooCommerce
≤1.99Update to 2.00
- High7.3Missing Authorization Checks
WP GDPR
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Catch Breadcrumb
<1.5.5Update to 1.5.5
- High7.3Missing Authorization
Timetable and Event Schedule by MotoPress
≤2.3.8Update to 2.3.9
- Medium6.4Authenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.7Update to 2.9.8
- Medium6.1Reflected Cross Site Scripting
Translate WordPress with GTranslate
≤2.8.51Update to 2.8.52
- High8.1Privilege Escalation via accept-to-be-teacher action parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- High7.1Authenticated Page Creation and Status Modification
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- High7.4Unauthorized Widget Import to Stored Cross-Site Scripting
Widget Settings Importer/Exporter
≤1.5.3No patch available
- Critical9.8Missing Authorization
TS Poll – Survey, Versus Poll, Image Poll, Video Poll
<1.3.4Update to 1.3.4
- Medium6.1Cross-Site Scripting
Advanced Order Export For WooCommerce
<3.1.4Update to 3.1.4
- High7.2Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.98Update to 0.99
- Medium5.4Authenticated Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
<0.99Update to 0.99
- High8.3Cross-Site Request Forgery
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.99No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Car Rental System
≤1.3No patch available
- Medium6.1Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting
Vanguard - Marketplace Digital Products PHP7
≤2.1No patch available
- High7.2Cross-Site Scripting
Online Hotel Booking System Pro
≤1.1No patch available
- Critical9.8Unauthenticated Settings Update
OneTone Companion
≤1.1.1No patch available
- High7.2Stored Cross-Site Scripting
OneTone Companion
≤1.1.1No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Contact Form 7 Datepicker
≤2.6.0No patch available
- Medium6.5Authenticated Map Creation/Deletion to Stored Cross-Site Scripting & Remote Code Execution
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
<2.53.9Update to 2.53.9
- High7.2Stored Cross-Site Scripting
Login by Auth0
≤3.11.3Update to 4.0.0
- High8.8Cross-Site Request Forgery
Login by Auth0
≤3.11.3Update to 4.0.0
- Critical9.8Unauthenticated SQL Injection
LearnDash LMS
≤3.1.5Update to 3.1.6
- Medium4.3Insecure Direct Object Reference
Login by Auth0
≤3.11.3Update to 4.0.0