Database
WordPress vulnerabilities listed in CISA KEV (page 141)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
<2.7.2.1Update to 2.7.2.1
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium5.3Unauthenticated Two-Factor Authentication Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.0Update to 9.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
TrustedSite
≤1.2.5Update to 1.2.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP QuickLaTeX
≤3.8.8No patch available
- Medium4.3Missing Authorization
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.3Update to 6.1.5
- High7.5Authenticated (Contributor+) PHP Object Injection
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.1.5Update to 2.1.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Bricksforge
≤3.1.8.8Update to 3.1.8.9
- High8.2Unauthenticated Path Traversal
ACF Frontend Admin by DynamiApps
≤3.29.12Update to 3.29.13
- Medium5.3Unauthenticated Payment Bypass
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.3Update to 4.5.4
- Medium4.3Cross-Site Request Forgery
Grand Tour | Travel Agency WordPress
≤5.5.1No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Graphene
≤2.9.4Update to 2.9.6
- Medium4.3Missing Authorization
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- High7.2File Uploads <= 3.3.26 - Unauthenticated Stored Cross-Site Scripting
Ninja Forms - File Uploads
≤3.3.26No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculation for contact form 7
≤1.0Update to 1.1
- Medium4.9Authenticated (Administrator+) SQL Injection
WPvivid — Backup, Migration & Staging
<0.9.133Update to 0.9.133
- Medium5.3Unauthenticated Information Exposure
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- Medium5.3Unauthenticated Product Price Manipulation
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<3.13.0Update to 3.13.0
- Medium5.3Missing Authorization to Unauthenticated Settings Update
WP Compress – Instant Performance & Speed Optimization
≤7.21.28Update to 7.22.0
- High7.5Unauthenticated Denial of Service
Migrate Guru – Site Migration & Cloning
≤6.65Update to 6.72
- High7.5Unauthenticated SQL Injection
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.174Update to 2.8.175
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Choosly – Product Variations Swatches for WooCommerce
≤1.1.18Update to 1.1.19
- Medium5.3Unauthenticated Unauthorized Order Status Manipulation
ePayco plugin for WooCommerce
<8.4.7Update to 8.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Under Construction
≤5.82Update to 5.83
- Medium4.3Cross-Site Request Forgery
Mang Board
≤2.3.8Update to 2.3.9
- Medium4.3Authenticated (Author+) Information Exposure
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- High7.5Unauthenticated Denial of Service
MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
≤6.69Update to 6.72
- High7.2Unauthenticated Stored Cross-Site Scripting
Breadcrumb NavXT
≤7.5.1Update to 7.5.2
- Medium5.3Missing Authorization
YITH Request a Quote for WooCommerce (Premium)
<4.46.0Update to 4.46.0
- High7.2Unauthenticated Stored Cross-Site Scripting
RTMKit for Elementor – Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready
≤2.1.5Update to 2.1.6