Database
WordPress vulnerabilities listed in CISA KEV (page 3)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
- Medium5.3Unauthenticated Information Exposure
WPZOOM Social Feed Widget & Block
≤2.4.1Update to 2.4.2
- Medium5.3Missing Authorization
Simply Schedule Appointments
≤1.6.13.0Update to 1.6.13.4
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Directory Kit
<1.6.3Update to 1.6.3
- Medium5.3Missing Authorization
Restrict User Access – Ultimate Membership & Content Protection
≤2.8.3Update to 2.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Live Composer – Free WordPress Website Builder
<2.1.24Update to 2.1.24
- Medium4.3Cross-Site Request Forgery
RestroPress – Online Food Ordering System
≤3.4.11Update to 3.5.0
- Medium5.3Missing Authorization
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership
≤3.5.0Update to 3.5.1
- Medium4.34.17.3 - Missing Authorization
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
4.16.13 – 4.17.3Update to 4.17.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.5Update to 1.5.1
- Medium5.3Missing Authorization
Security For WooCommerce
≤1.0.16No patch available
- Medium5.3Unauthenticated Information Exposure
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.6Update to 4.0.7
- Medium5.3Unauthenticated Information Exposure
WP Directory Kit
<1.6.3Update to 1.6.3
- Medium5.3Missing Authorization
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.13.0Update to 2.13.1
- Medium6.1Reflected Cross-Site Scripting
Knowledge Building
<0.7.3Update to 0.7.3
- Medium5.3Unauthenticated Information Exposure
Security For WooCommerce
≤1.0.16No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Knowledge Building
<0.7.3Update to 0.7.3
- Medium5.3Missing Authorization
Schema & Structured Data for WP & AMP
<1.70Update to 1.70
- Medium4.3Missing Authorization
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1235Update to 4.1236
- Medium4.3Authenticated (Author+) Insecure Direct Object Reference
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
<4.3.6Update to 4.3.6
- High8.8Authenticated (Author+) Arbitrary File Upload
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
<34.0.3Update to 34.0.3
- Medium4.3Cross-Site Request Forgery
Appointment Dark
≤1.3.4No patch available
- Medium5.3Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.31Update to 2.4.32
- Medium4.3Cross-Site Request Forgery
vdequator
≤1.2.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Event Post
≤6.1.2Update to 6.1.3
- Medium5.3Missing Authorization
Event Tickets and Registration
<5.30.3.1Update to 5.30.3.1
- Medium4.3Cross-Site Request Forgery
Shk Corporate
≤2.4.3No patch available
- Medium5.3Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.7.2Update to 2.8.0
- Medium5.3Missing Authorization
Security For WooCommerce
≤1.0.16No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GenerateBlocks
≤2.5.0Update to 2.5.1
- Medium5.3Unauthenticated Information Exposure
Security For WooCommerce
≤1.0.16No patch available