Database
WordPress vulnerabilities listed in CISA KEV (page 143)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.8.5Update to 5.8.6
- Medium5.3Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.22Update to 4.1.23
- Medium5.3Unauthenticated Payment Bypass
WP Express Checkout (Fast Payments via PayPal & Stripe)
≤2.4.8Update to 2.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Xpro Addons — 150+ Widgets for Elementor
≤1.7.3Update to 1.7.4
- High8.1Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection
Ninja Forms - Layout & Styles
≤3.0.31Update to 3.0.32
- High7.5Unauthenticated SQL Injection
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.1Update to 3.8.2
- Critical9.8Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter
Nokri – Job Board WordPress Theme
≤1.6.6Update to 1.6.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter
WPBakery Page Builder
≤8.7.4Update to 9.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
Welcart e-Commerce
≤2.12.1Update to 2.12.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)
Blocksy Companion
≤2.1.51Update to 2.1.52
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.12.1Update to 1.8.12.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤4.8.1Update to 4.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- High8.8Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token
Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
≤1.4.52Update to 1.4.53
- Medium4.9Authenticated (Administrator+) SQL Injection via 'product_order' Parameter
WP EasyCart: Shopping Cart and eCommerce Store
≤5.9.2Update to 5.9.3
- Medium5.3Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.17Update to 2.2.18
- High7.2Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function
Affiliate Super Assistent
≤1.10.2Update to 1.10.3
- Medium4.9Authenticated (Administrator+) SQL Injection via 's' Parameter
Photo Gallery by Ays – Responsive Image Gallery
≤6.8.2Update to 6.8.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie
Persistent Login
≤3.1.0Update to 3.1.1
- High7.2Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.1.9Update to 3.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute
Live Composer – Free WordPress Website Builder
≤2.1.19Update to 2.1.20
- High7.2Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter
Listdom: AI-powered Business Directory with Classifieds Ads Listings
≤5.8.1Update to 5.9.0
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.4Update to 4.4.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
ACF Frontend Admin by DynamiApps
≤3.29.11Update to 3.29.12
- High7.5Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
ACF Frontend Admin by DynamiApps
≤3.29.12Update to 3.29.13
- Critical9.8Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2