Database
WordPress vulnerabilities listed in CISA KEV (page 1303)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.1Cross-Site Scripting via Shortcodes
Iptanus File Upload
<4.3.3Update to 4.3.3
- Medium5.4Cross-Site Scripting
Relevanssi – A Better Search
≤4.0.4Update to 4.0.5
- Medium6.5Cross-Site Request Forgery to Denial of Service
WP Image Zoom
≤1.23Update to 1.24
- Medium5.3Sensitive Information Disclosure
WP Activity Log
≤3.1.1Update to 3.1.2
- Medium6.4Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.8.1.2Update to 5.8.1.2
- Critical9.8Local File Inclusion
Site Editor
≤1.1.1No patch available
- Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.32Update to 1.2.33
- Medium5.3Spam Injection
MailPoet Newsletters (Previous)
≤2.8.1Update to 2.8.2
- Critical9.8Object Injection
Newsletters
<4.6.8.6Update to 4.6.8.6
- High8.8Cross-Site Request Forgery
bbPress Move Topics
<1.1.5Update to 1.1.5
- High8.8PHP Object Injection
bbPress Move Topics
≤1.1.4Update to 1.1.6
- Medium6.1Multiple Cross-Site Scripting
Activity Log – Monitor User and Agent Changes
≤2.4.0Update to 2.4.1
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.6Update to 3.4.6
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.7Update to 3.4.7
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.7Update to 3.4.7
- Critical9.8Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
<1.2.0Update to 1.2.0
- Critical9.8Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
<1.2.0Update to 1.2.0
- High7.5Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
≤6.9.0Update to 6.9.1
- High7.5Sensitive Information Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.2.46Update to 2.2.50
- High7.5Information Disclosure
File Manager
≤5.0.0Update to 5.0.2
- Medium6.1Cross-Site Scripting
trust-form
≤2.0.0Update to 2.0.1
- High7.5Parameter Tampering
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.2.15Update to 3.2.15
- Critical9.8SQL Injection
WP Support Plus Responsive Ticket System
≤9.0.2Update to 9.0.3
- Medium6.1Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.2.14Update to 3.2.14
- High8.8Cross-Site Request Forgery
Church Admin
<1.2550Update to 1.2550
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium4.8Cross-Site Scripting via image alt and title text
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.2.44Update to 2.2.45
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0Update to 2.0.4
- High7.2Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤14.5Update to 14.6
- Critical9.8App Showcase & App Store WordPress Theme < 1.2.1 - Missing Authorization to Arbitrary Options Update
Swape - App Showcase & App Store WordPress Theme
<1.2.1Update to 1.2.1