Database
WordPress vulnerabilities listed in CISA KEV (page 136)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
HivePress Authentication
≤1.1.4Update to 1.1.5
- Critical9.8Unauthenticated Account Takeover via '_acf_objects' Object Identifier
ACF Frontend Admin by DynamiApps
≤3.29.12Update to 3.29.13
- Critical9.8Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
MemberDash
≤1.8.5Update to 1.8.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
<5.9.8Update to 5.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Greenshift – animation and page builder blocks
<13.2.0Update to 13.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
VikWidgetsLoader – Collection of Widgets
<1.12.0Update to 1.12.0
- Medium4.3Authenticated (Contributor+) Information Exposure
The Events Calendar
<6.17.3.1Update to 6.17.3.1
- Medium4.96.2.5 - Authenticated (Editor+) SQL Injection
Kirki – Freeform Page Builder, Website Builder & Customizer
6.0.0 – 6.2.5Update to 6.3.0
- Medium4.36.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
Kirki – Freeform Page Builder, Website Builder & Customizer
6.0.0 – 6.2.5Update to 6.3.0
- Medium4.3Missing Authorization
Search Atlas SEO – OTTO AI SEO Automation for WordPress
<2.6.24Update to 2.6.24
- Medium5.3Unauthenticated Information Exposure
My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam
<4.2.3Update to 4.2.3
- Medium6.5Authenticated (Contributor+) Path Traversal
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.21Update to 4.1.21
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Greenshift – animation and page builder blocks
<13.2.0Update to 13.2.0
- Medium4.95.0.0 - Authenticated (Administrator+) Path Traversal
JCH Optimize
4.2.1 – 5.0.0Update to 5.0.1
- Medium6.42.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
1.18.0 – 2.3.3Update to 3.4.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
CatFolders Document Gallery & PDF Library
<2.0.7Update to 2.0.7
- Medium4.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
<4.1.22Update to 4.1.22
- Medium4.34.0.7 - Authenticated (Contributor+) Insecure Direct Object Reference
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News
4.0.0 – 4.0.7Update to 4.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
<51.1.77Update to 51.1.77
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
<5.9.8Update to 5.9.8
- Medium6.5Authenticated (Contributor+) SQL Injection
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
<2.1.0Update to 2.1.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Accept Stripe Payments
<2.1.4Update to 2.1.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Joli Table Of Contents – Table of Contents with Gutenberg Block & Shortcode
<3.0.3Update to 3.0.3
- Medium4.34.6.3 - Missing Authorization
EmbedPress
4.6.0 – 4.6.3Update to 4.6.4
- Critical9.82.3.22 - Unauthenticated Hook Injection
Post Grid
2.2.85 – 2.3.22Update to 2.3.23
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
Pods – Custom Content Types and Fields
≤3.3.9.1Update to 3.3.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤3.3.2Update to 3.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting via IP Address Header
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.10.2Update to 1.10.3
- Medium6.1Reflected Cross-Site Scripting via 'formData[id]' Parameter
Unlimited Elements for Elementor
≤2.0.17Update to 2.0.18
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter
WP File Download
≤6.3.8Update to 6.3.9