Database
WordPress vulnerabilities listed in CISA KEV (page 5)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
- Medium4.3Cross-Site Request Forgery
WPIDE – File Manager & Code Editor
≤3.6.4Update to 3.6.5
- High7.5Authenticated (Contributor+) Local File Inclusion
All in One Addons For WPBakery Page Builder (formerly Visual Composer)
≤1.2No patch available
- Medium5.3Missing Authorization
Cargo Shipping Location for WooCommerce
<6.0Update to 6.0
- Medium5.3Unauthenticated Information Exposure
BulletProof Security
≤7.2No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Zion Builder – Website Builder for Speed & Creativity
≤3.6.17No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook
Avada (Fusion) Builder
≤3.16.1Update to 3.16.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Custom Field
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤7.8.1Update to 7.8.2
- High8.1Unauthenticated Authentication Bypass in Language-per-Domain SSO via 'wpml_sso_token_domain' Parameter
WPML Multilingual CMS
≤4.9.7Update to 5.0.0
- High8.2Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
≤3.6.2Update to 3.6.3
- High7.5Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser
Ultra Addons for Contact Form 7
≤3.5.54Update to 3.5.55
- Medium5.3Companies and Users Management for WooCommerce <= 2.1.4 - Unauthenticated Sensitive Information Exposure in /wp/v2/aio_company REST Endpoint
Extend B2B - Companies and Users Management for WooCommerce
≤2.1.4No patch available
- Critical9.8Unauthenticated Remote Code Execution
STAGGS – Product Configurator Toolkit
≤3.3.0Update to 3.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.9.1Update to 3.9.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤5.5.2.8Update to 5.5.2.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.2.1Update to 3.2.2
- Medium4.7Authenticated (Administrator+) Privilege Escalation
Post Duplicator
<3.0.18Update to 3.0.18
- High7.2Unauthenticated Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.202Update to 2.8.203
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Delivery & Pickup Date Time for WooCommerce
≤1.3.90Update to 1.3.91
- Medium5.3Unauthenticated Insecure Direct Object Reference
UniPAY Payment Gateway For WooCommerce
<2.4Update to 2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Meta Box – A Framework for Dynamic Websites
≤5.15.3Update to 5.15.4
- Medium5.3Missing Authorization
FOX – Currency Switcher Professional for WooCommerce
≤1.5.6Update to 1.5.7
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.1Update to 5.3.2
- High7.3Unauthenticated Privilege Escalation
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden
≤3.5.17Update to 3.5.18
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Activity Log
≤5.6.7Update to 5.6.8
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP w3all phpBB
≤3.1.9Update to 3.2.0
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤2.0.1Update to 2.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- High7.5Authenticated (Contributor+) Local File Inclusion
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.8Update to 2.3.10
- High7.5Authenticated (Author+) Local File Inclusion
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.8Update to 2.3.10
- Medium4.3Missing Authorization
Motors – Car Dealership & Classified Listings Plugin
≤1.4.128Update to 1.4.129