Database
WordPress vulnerabilities listed in CISA KEV (page 1326)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
Support Ticket System
<1.2.1Update to 1.2.1
- Medium6.12.7.9 - Unauthenticated DOM Cross-Site Scripting
uDesign - Responsive WordPress Theme
2.3.0 – 2.7.9Update to 2.7.10
- Medium6.1Reflected Cross-Site Scripting
Easy2Map
≤1.2.9Update to 1.3.0
- Critical9.8Directory Traversal and Local File Inclusion
Easy2Map
≤1.2.9Update to 1.3.0
- Medium6.1Reflected Cross-Site Scripting
Payment Form for PayPal Pro
<1.0.2Update to 1.0.2
- Medium6.1Reflected Cross-Site Scripting
ResAds
<1.0.2Update to 1.0.2
- Medium6.1Cross-Site Scripting
Quotes and Tips by BestWebSoft
<1.20Update to 1.20
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Relevant – Related, Featured, Latest, and Popular Posts by BestWebSoft
<1.0.8Update to 1.0.8
- High8.8Unauthenticated Remote Command Execution
WordPress Landing Pages
<1.9.2Update to 1.9.2
- High7.5Directory Traversal to Unauthenticated Arbitrary File Read
mTheme-Unus
<2.3Update to 2.3
- Medium6.1Multiple Reflected Cross-Site Scripting
Appointment Booking Calendar
≤1.1.7Update to 1.1.8
- Critical9.8SQL Injection
Appointment Booking Calendar
≤1.1.7Update to 1.1.8
- Medium6.1Cross-Site Scripting
xPinner Lite
≤2.2No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
ALO EasyMail Newsletter
<2.6.01Update to 2.6.01
- Medium6.4Cross-Site Scripting via Shortcodes
WordPress
≤4.3Update to 3.7.11 or 3.8.11 or 3.9.9 or 4.0.8 or 4.1.8 or 4.2.5 or 4.3.1
- Critical9.8Local File Inclusion
mypixs
≤0.3No patch available
- Medium5.4Authorization Bypass to Information Disclosure
WordPress
≤4.3Update to 3.7.11 or 3.8.11 or 3.9.9 or 4.0.8 or 4.1.8 or 4.2.5 or 4.3.1
- Medium6.4Authenticated Cross-Site Scripting
WordPress
≤4.3Update to 3.7.11 or 3.8.11 or 3.9.9 or 4.0.8 or 4.1.8 or 4.2.5 or 4.3.1
- Critical9.8SQL Injection
CP Reservation Calendar
<1.1.7Update to 1.1.7
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.15Update to 2.1.23
- Medium6.1Reflected Cross-Site Scripting
PowerPress Podcasting plugin by Blubrry
≤6.0.4Update to 6.0.5
- High8.8Cross-Site Request Forgery
xPinner Lite
≤2.2No patch available
- High7.5Path Traversal
estrutura-basica
all versionsNo patch available
- Medium6.1Cross-Site Scripting
RoyalSlider
<3.2.7Update to 3.2.7
- Medium6.1Cross-Site Scripting
Replyable – Subscribe to Comments and Reply by Email
<1.4.6Update to 1.4.6
- Medium6.5Cross-Site Forgery Request and Reflected Cross-Site Scripting
eShop
≤6.3.13Update to 6.3.14
- Medium6.1Cross-Site Scripting
Fast Secure Contact Form
≤4.0.37Update to 4.0.38
- Medium6.1Reflected Cross-Site Scripting
WP Symposium
≤15.8.1Update to 15.9
- Medium6.1Cross-Site Scripting
Gallery – Photo Albums Plugin
<1.3.50Update to 1.3.50
- Medium6.6PHP Object Injection
SecureMoz Security Audit
≤1.0.5No patch available