Database
WordPress vulnerabilities listed in CISA KEV (page 16)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
- Medium5.3Unauthenticated Insecure Direct Object Reference
Event Tickets Manager for WooCommerce
≤1.5.0Update to 1.6.0
- Medium5.3Unauthenticated Information Exposure
Pronamic Pay doneren met Mollie
≤11.0.0Update to 11.1.0
- Medium5.3Unauthenticated Information Exposure
WP Recipe Maker
≤10.9.1Update to 10.9.2
- High8.8Cross-Site Request Forgery to Administrator Account Creation
Komfortkasse for WooCommerce
≤1.4.8Update to 1.4.9
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
iLeads SMS Gateway by Exsile
≤1.0.0Update to 2.0.0
- Medium6.5Authenticated (Custom+) SQL Injection
Event Tickets with Ticket Scanner
≤3.2.8Update to 3.2.9
- Medium4.3Missing Authorization
Event Tickets with Ticket Scanner
≤3.1.13Update to 3.1.14
- High8.8Authenticated (Subscriber+) Privilege Escalation
Magic Link – Secure one click passwordless login
≤2.2.5Update to 2.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Add From Server Lite
≤5.0.0Update to 6.0.0
- Medium5.3Missing Authorization
Fiber Admin
≤4.0.0Update to 4.0.1
- Critical9.84.0.0 - Unauthenticated Remote Code Execution
Fiber Admin
3.1.0 – 4.0.0Update to 4.0.1
- Medium5.3Unauthenticated Information Exposure
Tournamatch
≤4.7.0Update to 4.7.1
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
Tournamatch
≤4.7.0Update to 4.7.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Live Composer – Free WordPress Website Builder
≤2.1.22Update to 2.1.23
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Medium4.3Authenticated (Subscriber+) Arbitrary Media Attachment Deletion
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Low2.7Missing Authorization
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10Update to 8.11
- Medium4.3Cross-Site Request Forgery
WP Google Review Slider
≤18.10Update to 18.11
- High7.2Unauthenticated Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.5.57.7211Update to 7.5.57.7212
- Critical9.86.2.3 - Unauthenticated Arbitrary File Upload
Contact Form 7
6.2 – 6.2.3Update to 6.2.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Live Composer – Free WordPress Website Builder
≤2.1.22Update to 2.1.23
- Medium5.3Unauthenticated Insecure Direct Object Reference
Antom Payments
≤2.0.11No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key
Redux Framework
≤4.5.16Update to 4.5.17
- High8.2Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching
LiteSpeed Cache
≤7.9.1Update to 7.9.2
- High8.1Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
Motors – Car Dealership & Classified Listings Plugin
≤1.4.128Update to 1.4.129
- High8.8Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.1Update to 4.19.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
Customer Reviews for WooCommerce
≤5.126.0Update to 5.127.0
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile
Redux Framework
≤4.5.16Update to 4.5.17