Database
WordPress vulnerabilities listed in CISA KEV (page 1289)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<4.0.2Update to 4.0.2
- High8.8Cross-Site Request Forgery
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤5.6Update to 5.6.1
- High8.8Cross-Site Request Forgery
Contact Form Email
≤1.2.65Update to 1.2.66
- High8.8Unauthenticated HTML Injection & Cross-Site Request Forgery
cformsII
<15.0.2Update to 15.0.2
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.3Update to 2.0.4
- Medium4.3Directory Traversal
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- High8.8Cross-Site Request Forgery
Social Feed Gallery
<2.4.8Update to 2.4.8
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.88Update to 2.0.4
- Critical9.8Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
GiveWP – Donation Plugin and Fundraising Platform
≤2.5.0Update to 2.5.1
- Medium6.1Cross-Site Scripting
Contact Form Email
≤1.2.65Update to 1.2.66
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Social LikeBox & Feed
≤2.8.4Update to 2.8.5
- Medium6.1Missing Authentication on Option Changes
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- Medium5.4Authenticated Stored Cross-Site Scripting
PPOM – Product Addons & Custom Fields for WooCommerce
<18.4Update to 18.4
- High7.2Missing Authorization
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- High8.8Cross-Site Request Forgery to Remote Code Execution
WP SVG Icons
<3.2.3Update to 3.2.3
- Critical9.8PHP Object Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<4.02.01Update to 4.02.01
- High7.5Arbitrary Post Deletion
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
≤2.2.5Update to 2.2.6
- Critical9.8Options Change
Restaurant Reservations
≤1.3Update to 1.5
- High8.8< 2.3 - Cross-Site Request Forgery
Pricing Table Plugin
<2.3Update to 2.3
- Medium6.1Unauthenticated Settings Update
Login or Logout Menu Item
<1.2.0Update to 1.2.0
- Critical9.8SQL Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.44Update to 3.45
- Medium6.1Open Redirect
Learning Courses
≤4.7Update to 4.8
- Critical9.6Unauthenticated Arbitrary Options Update
Hotel Booking
<2.5Update to 2.5
- Medium6.1Open Redirect
Travel Management
≤1.6.1Update to 1.7
- High8.2Unauthenticated Arbitrary Options Change
Donations
<1.4Update to 1.4
- High8.8Missing Authorization to Settings Import
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
<2.2.5Update to 2.2.5
- Medium6.1Unauthenticated WordPress Options Update
ND Shortcodes
<6.0Update to 6.0
- Critical9.8SQL Injection
JoomSport – for Sports: Team & League, Football, Hockey & more
<3.4Update to 3.4
- Critical9.1Directory Traversal
WP Fastest Cache – WordPress Cache Plugin
≤0.8.9.5Update to 0.8.9.6
- High8.8Cross-Site Request Forgery
Animate It!
≤2.3.5Update to 2.3.6