Database
WordPress vulnerabilities listed in CISA KEV (page 37)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode
≤3.9.6Update to 3.9.7
- Medium4.8Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
Advanced Custom Fields: Extended
≤0.9.2.6Update to 0.9.2.7
- Critical9.8Authentication Bypass via Social Login
Qode Membership
≤2.0.6.2Update to 2.0.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter
Jupiter X Core
≤4.61.0Update to 4.62.0
- High8.8Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.5Update to 6.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.7Update to 1.3.8
- Medium4.3Missing Authorization
Customer Coupons for WooCommerce
≤1.3.14Update to 1.3.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Button Block – Stylish buttons that get more clicks
≤1.2.7Update to 1.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Text Typing – grab attention with animated typing headlines
≤2.2.0Update to 2.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Content Slider Block – Bring your content to life with slides
≤3.2.1Update to 3.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All In One Lightbox – show any media in beautiful popups
≤1.2.0Update to 1.2.1
- Medium5.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.11Update to 4.4.12
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.11Update to 4.4.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.3.7Update to 1.3.8
- Medium5.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
≤2.4.10Update to 2.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Booking for Appointments and Events Calendar – Amelia
≤2.4.12Update to 2.4.13
- High7.2Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title
Analytics Insights – Google Analytics Dashboard for WordPress
≤6.3.12Update to 6.4
- High8.1Unauthenticated PHP Object Injection
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.13.1Update to 2.14.0
- High7.5Authenticated (Author+) PHP Object Injection
Filter Everything — WordPress & WooCommerce Filters
≤1.9.7Update to 1.9.8
- High7.5Authenticated (Contributor+) PHP Object Injection
Phoenix Media Rename
≤3.13.5Update to 3.13.6
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.3.1Update to 5.3.2
- High7.5Authenticated (Contributor+) PHP Object Injection
Logo Slider – Logo Carousel, Logo Showcase, Logo Gallery & Client Logos
≤3.8.9Update to 3.9.0
- Medium6.6Authenticated (Editor+) PHP Object Injection
Accordions
≤2.3.25No patch available
- High8.1Unauthenticated PHP Object Injection
Zoho Flow – No-Code Workflow Automation
≤2.14.5Update to 2.14.6
- Medium5.3Missing Authorization
Optima Express IDX
≤9.0.1No patch available
- Medium4.3Missing Authorization
Redux Framework
≤4.5.16Update to 4.5.17
- Medium6.5Authenticated (Subscriber+) SQL Injection
BuddyPress
≤14.5.2Update to 14.5.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliate Program Suite — SliceWP Affiliates
≤1.2.13Update to 1.2.14
- Medium5.3Unauthenticated Information Exposure
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.10.5Update to 1.10.7
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.24Update to 2.0.25