Database
WordPress vulnerabilities listed in CISA KEV (page 1342)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Request Forgery
DandyID Services
≤1.5.9No patch available
- Medium6.1Cross-Site Scripting
Mikiurl Wordpress Eklentisi
≤2.0No patch available
- Medium6.1Cross-Site Scripting
wpCommentTwit
≤0.5No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
IP Ban
≤1.2.3Update to 1.2.4
- Medium6.1Cross-Site Request Forgery
Timed Popup WordPress Plugin
≤1.4No patch available
- High8.8Cross-Site Request Forgery
Lightbox Photo Gallery
≤1.0No patch available
- High7.2Cross-Site Scripting
Simple visitor stat
≤1.0No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
WP-ViperGB
≤1.3.10Update to 1.3.11
- High7.1Cross-Site Scripting
Easy Social Like Box – Popup – Sidebar Widget
<2.8.3Update to 2.8.3
- Medium6.1Cross-Site Scripting
Our Team Showcase
<1.3Update to 1.3
- Critical9.8Arbitrary File Upload
WP Symposium
≤14.11Update to 15.1
- Medium4.3Cross-Site Request Forgery
W3 Total Cache
≤0.9.4Update to 0.9.4.1
- Medium6.1Cross-Site Scripting
Simplelife
≤1.2No patch available
- High8.8Cross-Site Request Forgery
TweetScribe
≤1.1No patch available
- Medium6.3Cross-Site Request Forgery
twitter-liveblog
≤1.1.2No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Twimp WP
≤0.1No patch available
- Medium6.1Cross-Site Request Forgery
bird-feeder
≤1.2.3No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
twitterDash
≤2.1No patch available
- Medium6.1Cross-Site Request Forgery
yurl-retwitt
≤1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
<5.1.5Update to 5.1.5
- Critical9.8Local File Inclusion
ChurcHope
≤2.1Update to 2.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Broken Link Checker
<1.10.2Update to 1.10.2
- Medium5.3CAPTCHA Bypass
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms
<4.0.7Update to 4.0.7
- High8.8SQL Injection
Cart66 Lite :: WordPress Ecommerce
<1.5.2Update to 1.5.2
- Medium6.5Unauthenticated Arbitrary File Read
google-mp3-audio-player
≤1.0.11Update to 1.0.12
- Medium6.1Reflected Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<2.8.10Update to 2.8.10
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
≤2.0.6Update to 2.0.7
- High7.2JavaScript Injection
Rich Counter
<1.2.0Update to 1.2.0
- Medium6.1Cross-Site Scripting
WP Symposium
≤14.10Update to 14.11
- Medium6.1Cross-Site Scripting
InstaSqueeze Sexy Squeeze Pages
all versionsNo patch available