Database
WordPress vulnerabilities listed in CISA KEV (page 142)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ultimate Before After Image Slider & Gallery – BEAF
<4.7.19Update to 4.7.19
- High7.5Unauthenticated Denial of Service
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.0Update to 9.8.1
- Medium4.3Cross-Site Request Forgery
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
<2.7.2.1Update to 2.7.2.1
- High7.5Unauthenticated SQL Injection
Comments – wpDiscuz
<7.6.66Update to 7.6.66
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Ultimate Before After Image Slider & Gallery – BEAF
<4.7.19Update to 4.7.19
- Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
<3.7.46Update to 3.7.46
- Medium5.3Unauthenticated Insecure Direct Object Reference
MotoPress Appointment Booking
<2.4.8Update to 2.4.8
- Medium5.3Unauthenticated Forged Payment Completion
Restaurant Menu and Food Ordering
<2.4.12Update to 2.4.12
- High7.2Unauthenticated Server-Side Request Forgery
LiteSpeed Cache
≤7.9Update to 7.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
Easy Waveform Player
≤1.2.2Update to 1.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
Broken Link Checker
≤2.4.13Update to 2.4.13.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
Divi
≤4.27.5Update to 4.27.7
- Critical9.8Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
SigmaForms Pro – AI Generated Forms
≤1.4.11Update to 1.4.12
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
DevKit Pro
≤2.3.0Update to 2.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
Divi
≤4.27.6Update to 4.27.7
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
WP File Download
≤6.3.4Update to 6.3.5
- High8.1Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
Gravity Forms
≤3.0.2Update to 3.0.3
- High7.5Authenticated (Subscriber+) PHP Object Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.10Update to 4.3.11
- Critical9.89.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
Booking for Appointments and Events Calendar – Amelia
8.0 – 9.6.2Update to 9.6.3
- High7.2Unauthenticated Stored Cross-Site Scripting
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.13.1Update to 5.14
- High8.8Authenticated (Subscriber+) Remote Code Execution
WatchMan-Site7
≤4.2.0No patch available
- Medium5.3Unauthenticated Information Exposure
Product Attachment for WooCommerce
≤2.3.4Update to 2.3.5
- Medium6.1Reflected Cross-Site Scripting
MapGeo – Interactive Geo Maps
≤1.6.30No patch available
- Medium6.4Authenticated (Customer+) Stored Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects
≤4.5.1Update to 4.6
- Medium4.3Authenticated (Contributor+) Arbitrary CSS Injection
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
≤2.5.0Update to 2.5.1
- Critical9.8Unauthenticated Privilege Escalation
Authorizer
≤3.15.1Update to 3.15.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤5.0.0.0Update to 5.0.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.
≤3.1.5Update to 3.1.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress
≤1.3.1No patch available