Database
WordPress vulnerabilities listed in CISA KEV (page 1332)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Arbitrary Options Update
Vernissage - Photography WordPress Theme
≤1.2.9Update to 1.3
- High8.8Fullscreen Portfolio & Blog HTML Theme <= 1.3.2 - Arbitrary Options Update
Simpolio - Fullscreen Portfolio & Blog HTML Theme
≤1.3.2No patch available
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
≤1.0.6Update to 1.0.7
- Critical9.8Unauthenticated SQL Injection
Email Newsletter
≤20.15No patch available
- Medium6.1Reflected Cross-Site Scripting
Nextend Twitter Connect
≤1.5.1Update to 1.5.2
- Medium6.1Reflected Cross-Site Scripting
Nextend Social Login and Register
<1.5.6Update to 1.5.6
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
WP Accurate Form Data
≤1.2No patch available
- High8.8Cross-Site Request Forgery
Analyticator
<6.4.9.4Update to 6.4.9.4
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Erident Custom Login Page & Dashboard
≤3.4.1Update to 3.5
- Medium4.3Cross-Site Request Forgery
WP-Stats
<2.52Update to 2.52
- Medium6.1Cross-Site Scripting
WordPress Landing Pages
≤1.8.7Update to 1.8.8
- Medium6.1Cross-Site Scripting
Altos Connect
≤1.3.0No patch available
- High7.5Path Traversal
WordPress Renaming Tool by Vlajo
≤1.0No patch available
- High8.6Directory Traversal
Zip Attachments
≤1.5Update to 1.5.1
- Critical9.8Unauthenticated Local File Inclusion
robotcpa
≤5No patch available
- Medium5.3Path Traversal to Arbitrary File Read
PayPal Currency Converter BASIC for WooCommerce
≤1.3Update to 1.4
- Critical9.8Arbitrary File Upload
Aviary Image Editor Add-on For Gravity Forms
≤3.0 (Beta r7)No patch available
- Critical9.8SQL Injection
Easy2Map Photos
≤1.0.9Update to 1.1.0
- Critical9.8SQL Injection
Easy2Map
<1.2.5Update to 1.2.5
- Medium5.3Path Traversal
Easy2Map Photos
≤1.0.9Update to 1.1.0
- Critical9.8SQL Injection
NewStatPress
≤1.0.0Update to 1.0.1
- Medium6.5Directory Traversal
Easy2Map
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
Encrypted Contact Form
<1.1Update to 1.1
- Critical9.8Directory Traversal
SE HTML5 Album Audio Player
≤1.1.0No patch available
- Critical9.8Local File Inclusion
ZM Ajax Login & Register
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5.7.1Update to 5.5.7.1
- Critical9.8Multiple SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
≤1.5.15Update to 1.5.16
- Medium6.1Cross-Site Scripting
ZM Ajax Login & Register
≤1.0.9Update to 1.1.0
- High8.8Cross-Site Request Forgery to Remote Code Execution
Codestyling Localization
≤1.99.30No patch available
- Medium6.1Reflected Cross-Site Scripting
Simple Share Buttons Adder
<6.0.1Update to 6.0.1