Database
WordPress vulnerabilities listed in CISA KEV (page 1291)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
One Click SSL
<1.4.7Update to 1.4.7
- Medium6.3Unauthorized Settings Update
LoginPress | wp-login Custom Login Page Customizer
≤1.1.13Update to 1.1.14
- High7.2Authenticated SQL Injection
AdRotate Banner Manager
≤5.2Update to 5.3
- Medium6.5Information Exposure
WPGraphQL
≤0.3.4Update to 0.3.5
- Medium6.1Reflected Cross-Site Scripting
Simple Link Directory – AI Powered
<7.3.5Update to 7.3.5
- Medium6.1Reflected Cross-Site Scripting
Gallery PhotoBlocks
<1.1.43Update to 1.1.43
- Medium6.4Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
≤1.10.28.2Update to 1.10.29
- Medium6.4Authenticated Stored Cross Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤11.5Update to 11.6-RC5
- Medium6.1Cross-Site Scripting
Appointment Hour Booking – Booking Calendar
<1.1.46Update to 1.1.46
- High7.2SQL Injection
Rencontre – Dating Site
<3.1.3Update to 3.1.3
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<7.11.35Update to 7.11.35
- Medium4.8Cross-Site Scripting
Rencontre – Dating Site
<3.1.3Update to 3.1.3
- Medium5.3Missing Authorization
WP Like Button
<1.6.1Update to 1.6.1
- Medium6.1Cross-Site Scripting
Appointment Booking Calendar
<1.3.19Update to 1.3.19
- High7.5Unauthenticated Options update and CSS injection
Ocean Extra
≤1.5.8Update to 1.5.9
- High8.8Cross-Site Request Forgery
Visitor Traffic Real Time Statistics
≤1.13Update to 1.14
- Critical9.8SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<3.1.2Update to 3.1.2
- High8.8Cross-Site Request Forgery
Visitor Traffic Real Time Statistics
≤1.12Update to 1.13
- Medium6.1Reflected Cross-Site Scripting
Simple Mail Address Encoder
<1.7Update to 1.7
- Medium6.5Directory Traversal
Insert or Embed Articulate Content into WordPress
<4.29991Update to 4.29991
- High8.8Directory Traversal
Newsletters
<4.6.19Update to 4.6.19
- Medium5.4Cross-Site Scripting via contentarea Parameter
Newsletters
<4.6.19Update to 4.6.19
- Critical9.8Unauthenticated Blind SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.6.1Update to 12.6.7
- High8.8Cross-Site Request Forgery
Widget Logic
<5.10.2Update to 5.10.2
- Critical9.8Code Injection
Easy Forms for Mailchimp
<6.5.3Update to 6.5.3
- High8.8SQL Injection
Server Status by Hostname/IP
≤4.6Update to 5.0
- Medium6.1Cross-Site Scripting
Easy restaurant menu manager
≤1.1.2Update to 1.2
- High8.8Cross-Site Request Forgery
Converter for Media – Optimize images | Convert WebP & AVIF
≤1.0.2Update to 1.0.3
- High8.8Cross-Site Request Forgery
ACF: Better Search
<3.3.1Update to 3.3.1
- High8.8Cross-Site Request Forgery
WP Better Permalinks
<3.0.5Update to 3.0.5