Database
WordPress vulnerabilities listed in CISA KEV (page 130)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.9.7Update to 7.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Bold Timeline Lite
≤1.2.8Update to 1.3.0
- High7.5Unauthenticated Arbitrary File Read via 'user[name]' Parameter
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.0.4Update to 11.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
Media Library Assistant
≤3.35Update to 3.36
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
Media Library Assistant
≤3.35Update to 3.36
- Medium5.3Payment Bypass to Unauthenticated Arbitrary Booking Price and Payment Method Bypass
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
<1.2.0Update to 1.2.0
- Critical9.11.2.2 - Unauthenticated Arbitrary File Deletion
CryptoPayment Gateway
1.2.1 – 1.2.2No patch available
- Medium4.3Authenticated (Custom Role+) Persistent Access After Login Revocation
Temporary Login Without Password
<1.9.9Update to 1.9.9
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard
≤1.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
Media Library Assistant
≤3.35Update to 3.36
- Medium5.3Missing Authorization
Flexible Quantity & Price Calculator for WooCommerce
≤2.3.21Update to 2.3.22
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.24Update to 1.0.25
- Medium4.3Cross-Site Request Forgery
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.1.5Update to 2.1.6
- Medium4.3Missing Authorization
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.0Update to 3.4.1
- Medium5.3Missing Authorization
Advanced Partial Payment or Deposit for WooCommerce
≤3.1.0Update to 4.0.1
- Medium5.33.2.9 - Unauthenticated Information Exposure
Ultimate Gift Cards for WooCommerce
3.0.3 – 3.2.9Update to 3.2.10
- High7.5Authenticated (Subscriber+) PHP Object Injection
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.0Update to 3.4.1
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Gpx2Graphics
≤0.3No patch available
- Medium5.39.8.0 - Unauthenticated Payment Bypass
Booking for Appointments and Events Calendar – Amelia
9.0 – 9.8.0Update to 9.8.1
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤4.7.5Update to 4.7.6
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Option Modification
Notiqoo – Order Notification & Customer Chat for WooCommerce
<1.4.14Update to 1.4.14
- Medium5.3Unauthenticated Information Exposure
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤8.5.9Update to 8.6.0
- High7.51.2.14 - Unauthenticated SQL Injection
Quentn WP
1.2.13 – 1.2.14Update to 1.2.15
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
WebTotem Backups
<1.1.0Update to 1.1.0
- Critical9.8Authentication Bypass to Admin
Frontegg SAML SSO
≤1.0.1No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.5Update to 11.2.6
- Medium4.3Cross-Site Request Forgery
Site Kit by Google – Analytics, Search Console, AdSense, Speed
≤1.186.0Update to 1.187.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Visual Composer Website Builder
≤45.16.1Update to 45.16.2
- High8.8Authenticated (Author+) Arbitrary File Upload
Insert or Embed Articulate Content into WordPress
<4.3000000025Update to 4.3000000027
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
Redux Framework
≤4.5.13.1Update to 4.5.14