Database
WordPress vulnerabilities listed in CISA KEV (page 1337)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2015-9375 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9374 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9363 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9376 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9359 | — | |
| Medium6.1 | Quota < 1.2.5 - Cross-Site Scripting | CVE-2015-9534 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9533 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9296 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9367 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9528 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9366 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9378 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9515 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9531 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9527 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9371 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9377 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9525 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9355 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9372 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9523 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9514 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9522 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-10110 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2014-4518 | — | |
| High7.5 | Missing Access Controls | CVE-2015-9337 | — | |
| Medium5.3 | SQL Injection | CVE-2015-3325 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9493 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-10137 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9333 | — |
- Medium6.1Cross-Site Scripting
exchange-addon-table-rate-shipping
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Stripe Add-on for iThemes Exchange
<1.2.0Update to 1.2.0
- Medium6.1Cross-Site Scripting
ithemes-exchange
<1.12.0Update to 1.12.0
- Medium6.1Reflected Cross-Site Scripting
Mobile
<1.2.8Update to 1.2.8
- Medium6.1Reflected Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<3.4.3Update to 3.4.3
- Medium6.1Quota < 1.2.5 - Cross-Site Scripting
Easy Digital Downloads - Quota
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
Lattice
<1.1.5Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
Download Monitor
<1.7.1Update to 1.7.1
- Medium6.1Reflected Cross-Site Scripting
Easy Canadian Sales Taxes Add-On for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Software Licensing
<3.2.3Update to 3.2.3
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Custom URL Tracking
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Market
<5.1.27Update to 5.1.27
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – htaccess Editor
1.0.0 – 1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
Easy Digital Downloads - Wish Lists
≤1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Simple Shipping
≤2.1.3Update to 2.1.4
- Medium6.1Reflected Cross-Site Scripting
Manual Purchases Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
BuilderChild-Depot
<5.0.30Update to 5.0.30
- Medium6.1Cross-Site Scripting
Easy Digital Downloads - Recurring Payments
≤2.3Update to 2.3.1
- Medium6.1Cross-Site Scripting
Two Factor Authentication
<1.1.10Update to 1.1.10
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Membership
<1.3.0Update to 1.3.0
- Medium6.1Cross-Site Scripting
Recommended Products - EDD
≤1.2.3.2Update to 1.2.3.3
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads - Free Downloads
≤2.3.6Update to 2.3.7
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads - QR Codes
≤1.1.0Update to 1.1.1
- Medium6.1Reflected Cross-Site Scripting
TinyChat Room Spy
≤1.2.8Update to 1.2.9
- Medium5.3Cross-Site Scripting
Contact Form by ContactMe.com
≤2.3No patch available
- High7.5Missing Access Controls
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.1.3Update to 2.1.4
- Medium5.3SQL Injection
WP Symposium
<15.4Update to 15.4
- Medium6.1Cross-Site Scripting
My Wish List
<1.4.2Update to 1.4.2
- Critical9.8Arbitrary File Upload
Website Contact Form With File Upload
≤1.3.4Update to 1.4
- Critical9.8SQL Injection
cformsII
<14.6.10Update to 14.6.10