Database
WordPress vulnerabilities listed in CISA KEV (page 144)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) SQL Injection
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.12.1Update to 1.8.12.2
- High7.2Unauthenticated Stored Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium4.3Authenticated (Subscriber+) Information Exposure
Barcode Generator: Print Product and Order Labels with Barcodes (A4, Thermal/Roll, Letter)
≤4.0.0Update to 4.0.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Kalles Addons
≤1.0.6No patch available
- High7.2Unauthenticated Server-Side Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
≤8.15.0Update to 8.16.0
- Medium5.3Missing Authorization to Unauthenticated Unpublished Site Builder Content Disclosure
Solace Extra
<1.7.0Update to 1.7.0
- High7.5Authenticated (Subscriber+) PHP Object Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.10Update to 4.3.11
- High7.3Unauthenticated Privilege Escalation
Uix UserCenter
≤1.0.3No patch available
- Medium4.3Cross-Site Request Forgery
JetStyleManager for Gutenberg
<1.3.9Update to 1.3.9
- Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Post/User Meta Overwrite
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277Update to 1.0.277
- High7.3Unauthenticated Privilege Escalation
MemberHero – Simple User Registration & Login
≤6.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.2Update to 3.8.3
- Medium5.3Unauthenticated Payment Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9
- Medium5.3Missing Authorization
bbPress
≤2.6.14Update to 2.6.15
- High8.8Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting
FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]
≤8.0.1Update to 8.0.2
- Medium5.3Unauthenticated Password-Protected Post Content Disclosure
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.277.1Update to 1.0.277.1
- High7.5Unauthenticated SQL Injection
Rest Routes – Custom Endpoints for WordPress REST API
≤5.5.5No patch available
- High8.1Unauthenticated Arbitrary Plugin Installation via Brute Force
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.1Update to 4.17.2
- Critical9.8Unauthenticated Arbitrary File Upload
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode
WP Recipe Maker Premium
≤10.5.0Update to 10.6.0
- Medium5.35.0.14 - Unauthenticated Information Exposure
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
5.0.13 – 5.0.14Update to 5.0.15
- High7.3Unauthenticated Arbitrary User Account Takeover
OAuth Single Sign On – SSO (OAuth Client)
≤7.0.0Update to 7.0.1
- Critical9.8Unauthenticated Privilege Escalation via Administrator Account Takeover
Advanced Custom Fields: Extended
<0.9.2.7Update to 0.9.2.7
- Medium4.9Authenticated (Admin+) Denial of Service
Kubio AI Page Builder
<2.9.1Update to 2.9.1
- High7.2Unauthenticated Server-Side Request Forgery
Total processing card payments for WooCommerce
≤7.3No patch available
- Medium5.3Unauthenticated Information Exposure
HEL Online Classroom: AI-powered Online Classrooms
≤1.0.3No patch available
- Medium5.3Missing Authorization
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<4.0.1Update to 4.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Customer Reviews for WooCommerce
<5.118.0Update to 5.118.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
≤0.8.7Update to 0.8.8
- Medium5.3Unauthenticated Payment Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤6.0.9.8Update to 6.0.9.9