Database
WordPress vulnerabilities listed in CISA KEV (page 1324)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
- High8.8Multiple SQL Injections
eShop
≤6.3.14No patch available
- Medium6.1Multiple Cross-Site Scripting
eShop
≤6.3.14No patch available
- Medium5.4Open Redirect via wp_validate_redirect
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- High8.8Cross-Site Request Forgery
Simple add pages or posts
<1.7Update to 1.7
- Medium6.4Server-Side Request Forgery
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- Medium6.1Cross-Site Scripting
Connections Business Directory
<8.5.9Update to 8.5.9
- Medium6.4Cross-Site Scripting
Sola Support Tickets
<3.13Update to 3.13
- Medium6.1Reflected Cross-Site Scripting
IMPress Listings
≤2.0.1Update to 2.0.2
- High8.8SQL Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤1.07.11Update to 2.0
- Critical9.8SQL Injection
Appointment Booking Calendar
<1.1.24Update to 1.1.24
- High7.5Authentication Bypass
OneLogin SAML SSO
<2.2.0Update to 2.2.0
- Medium5.5Cross-Site Scripting via Theme Names
WordPress
≤4.4Update to 3.7.12 or 3.8.12 or 3.9.10 or 4.0.9 or 4.1.9 or 4.2.6 or 4.3.2 or 4.4.1
- Medium5.3Remote Code Execution
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
<1.1.4.6Update to 1.1.4.6
- High8.8Unrestricted File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.10Update to 2.1.15
- Medium6.4Stored Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- Medium6.1Reflected Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- Medium6.5Cross-Site Request Forgery
mTouch Quiz
<3.1.3Update to 3.1.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
mTouch Quiz
<3.1.3Update to 3.1.3
- High8.8SQL Injection
Welcart e-Commerce
<1.5.3Update to 1.5.3
- Medium4.3Missing Authorization Checks
Admin Management Xtended
≤2.4.0Update to 2.4.0.1
- Critical9.8SQL Injection
Smart External Link Click Monitor [Link Log]
<2.1Update to 2.1
- Medium6.1Cross-Site Scripting
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.2No patch available
- Medium6.4Cross-Site Scripting
Content text slider on post
<6.9Update to 6.9
- Medium6.1Reflected Cross-Site Scripting
Role Scoper (Obsolete – Please install PublishPress Permissions)
<1.3.67Update to 1.3.67
- High8.8Cross-Site Request Forgery
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- High8.8Authenticated Command Injection
Cool Video Gallery
<2.0Update to 2.0
- Medium5.4Cross-Site Scripting via p_name parameter
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.29Update to 1.3.29