Database
WordPress vulnerabilities listed in CISA KEV (page 4)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
- Medium4.3Missing Authorization
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.9.9Update to 7.9.10
- Medium5.3Missing Authorization
Restrict User Access – Ultimate Membership & Content Protection
≤2.8.3Update to 2.8.4
- Medium4.3Cross-Site Request Forgery
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
<6.0.8Update to 6.0.8
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Photo Engine (Media Organizer & Lightroom)
<6.6.2Update to 6.6.2
- Medium4.3Missing Authorization
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.51.0Update to 3.51.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YITH WooCommerce Ajax Search
≤2.30.0Update to 2.30.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Passster – Password Protect Pages and Content
≤4.3.21Update to 4.3.22
- Medium4.3Missing Authorization
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.7.2Update to 2.8.0
- Medium5.3Missing Authorization
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<4.17.6Update to 4.17.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Dynific Addons for Elementor (formerly Anywhere Elementor)
<1.3.1Update to 1.3.1
- Medium5.3Missing Authorization
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
<3.3.7Update to 3.3.7
- Medium4.3Cross-Site Request Forgery
Spasalon
≤3.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.12.1Update to 4.13.0
- Medium5.3Unauthenticated Information Exposure
Hubbub Lite – Fast, free social sharing and follow buttons
≤1.36.3.1Update to 1.36.3.2
- Medium5.3Missing Authorization
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<4.17.6Update to 4.17.6
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery
Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security
<3.4.2Update to 3.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
<4.3.6Update to 4.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
≤5.9.11Update to 5.9.12
- Medium4.3Missing Authorization
WP Extended – Modular WordPress Toolkit
≤3.4.2Update to 3.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
bBlocks – Essential Gutenberg Blocks & Patterns Collection
≤2.1.15Update to 2.1.16
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
Author Image
≤4.9.3No patch available
- High8.8Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset()
Reset Database
≤1.1.3No patch available
- High8.8Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'six_storage_online_api_url' Option Poisoning + Transient-Backed Auth Bypass
6Storage Rentals
≤2.31.0No patch available
- Medium6.1Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable
Joinchat – Enhanced “click to chat”
≤6.3.1Update to 6.3.2
- High8.1Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header
ARforms
≤7.2.4Update to 7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Referer Header
ARforms
≤7.2.4Update to 7.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
ARforms
≤7.2.4Update to 7.3
- Medium6.1Reflected Cross-Site Scripting via 'text_no_products' Parameter
Product Filter for WooCommerce by WBW
≤3.4.5Update to 3.4.6
- Critical9.8Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt
Basel Post Types
≤1.18Update to 1.19
- High7.5Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.3No patch available