Database
WordPress vulnerabilities listed in CISA KEV (page 1325)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated Command Injection
Cool Video Gallery
<2.0Update to 2.0
- High8.8Authenticated Blind SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.64Update to 1.5.64
- Critical9.8SQL Injection
Google Doc Embedder
<2.5.17Update to 2.5.17
- Medium6.1Reflected Cross-Site Scripting
Auto Thickbox Plus
≤1.9No patch available
- High7.2Authenticated SQL Injection
WP-Stats-Dashboard
≤2.9.4No patch available
- Critical9.8SQL Injection
Double Opt-In for Download
<2.0.9Update to 2.0.9
- Medium6.1Reflected Cross-Site Scripting
Websimon Tables
≤1.3.4No patch available
- High7.2Authenticated (Admin+) SQL Injection
Watu Quiz
≤2.6.7Update to 2.6.8
- High8.8Arbitrary File Upload
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.59Update to 1.5.59
- Critical9.8SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.8.4.9Update to 0.8.4.9
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.2.5Update to 2.2.5
- High8.8Cross-Site Request Forgery
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- Medium6.1Cross-Site Scripting
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Critical9.0Remote File Inclusion
Gwolle Guestbook
<1.5.4Update to 1.5.4
- Medium6.1Cross-Site Scripting
WordPress Calls to Action
<2.5.1Update to 2.5.1
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.4.1Update to 3.4.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Crony Cronjob Manager
<0.4.7Update to 0.4.7
- Critical9.8SQL Injection
Visitors Online by BestWebSoft
≤0.3Update to 0.4
- High8.8SQL Injection
wp-championship
<5.9Update to 5.9
- High8.8Authenticated SQL Injection
Dynamic Widgets
≤1.5.10Update to 1.5.11
- Medium6.1Cross-Site Scripting
Akismet Anti-spam: Spam Protection
<3.1.5Update to 3.1.5
- Medium6.1Cross-Site Scripting
Connect Matomo – Analytics Dashboard for WordPress
<1.0.5Update to 1.0.5
- Medium4.9Path Traversal
Font – official webfonts plugin of Fonts For Web. NO CODING! Just click & change font size, color and font face visually!
≤7.5Update to 7.5.1
- Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
<2.0.19Update to 2.0.19
- Medium6.3Authenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<2.0.19Update to 2.0.19
- High8.8Arbitrary File Upload
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
≤2.8.1.1Update to 2.8.1.2
- Critical9.8SQL Injection
Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms
<1.1.1Update to 1.1.1
- High7.5Arbitrary File Download
History Collection
≤1.1.1No patch available