Database
WordPress vulnerabilities listed in CISA KEV (page 17)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
- Medium4.3Missing Authorization
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.
≤3.1.6Update to 3.1.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.3Update to 1.58.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.5Update to 4.3.6
- Medium6.1Reflected Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.5Update to 4.3.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Redux Framework
≤4.5.16Update to 4.5.17
- High7.2Unauthenticated Stored Cross-Site Scripting
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.4.15Update to 3.8.4.16
- Medium5.3Unauthenticated Information Exposure
FloristPress for Woo – Customize your eCommerce store for your Florist
≤7.8.4Update to 7.8.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
≤4.3.0Update to 4.3.1
- High7.2Unauthenticated Server-Side Request Forgery
Stape Conversion Tracking
<2.3.11Update to 2.3.11
- High8.1Unauthenticated PHP Object Injection
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events
≤1.0.20Update to 1.0.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
VikWidgetsLoader – Collection of Widgets
<1.12.3Update to 1.12.3
- Medium4.3Missing Authorization
Advanced Custom Fields (ACF®)
≤6.8.10Update to 6.8.11
- Medium6.3Authentication Bypass via SAML Relay
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤45.1Update to 45.2
- Medium4.32.0.2 - Authenticated (Custom+) Payment Bypass
wePOS – Point Of Sale (POS) for WooCommerce & Dokan
1.2.6 – 2.0.2Update to 2.0.3
- Medium5.3Unauthenticated Payment Processing Bypass
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.62Update to 2.8.63
- Medium4.3Missing Authorization
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.62Update to 2.8.63
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Premium Packages – Sell Digital Products Securely
<7.3.1Update to 7.3.1
- High7.20.9.136 - Authenticated (Administrator+) Arbitrary File Upload
WPvivid — Backup, Migration & Staging
0.9.117 – 0.9.136Update to 0.9.137
- Medium4.3Missing Authorization
Simple Download Monitor
<4.1.3Update to 4.1.3
- Medium5.3Unauthenticated Free Confirmed Booking Creation
Booking Package
<1.7.34Update to 1.7.34
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
<1.15.51Update to 1.15.51
- Medium4.3Missing Authorization
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
<1.17.11Update to 1.17.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CookieYes – Cookie Banner, Cookie Consent & Cookie Notice for GDPR/CCPA
<3.5.8Update to 3.5.8
- Medium5.3Missing Authorization
Mollie Payments for WooCommerce
<8.2.0Update to 8.2.0
- Medium4.36.8.10 - Authenticated (Contributor+) Insecure Direct Object Reference
Advanced Custom Fields (ACF®)
6.2.0 – 6.8.10Update to 6.8.11
- Medium4.3Authenticated (Contributor+) Information Exposure
Advanced Custom Fields (ACF®)
≤6.8.10Update to 6.8.11
- Medium5.36.4.0 - [Fill this out]
Pay with Vipps and MobilePay for WooCommerce
5.0.0 – 6.4.0Update to 6.4.1
- Medium5.39.18 - Unauthenticated Unpaid Event Registration Confirmation
Quick Event Manager
9.9.5 – 9.18Update to 9.19
- Medium5.3Unauthenticated Payment Bypass
Order Tracking – WordPress Status Tracking Plugin
≤3.5.0Update to 3.6.0