Database
WordPress vulnerabilities listed in CISA KEV (page 51)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.31.2.9 - Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium6.1Reflected Cross-Site Scripting
WP Photo Album Plus
≤9.2.11.1Update to 9.2.11.002
- High8.810.31.10 - Authenticated (Salon Staff+) Privilege Escalation
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
10.17 – 10.31.10Update to 10.31.11
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Blaze Demo Importer
≤1.0.16Update to 1.0.17
- Medium5.35.7.0 - Missing Authorization
App Builder – Create Native Android & iOS Apps On The Flight
3.8.4 – 5.7.0Update to 5.7.1
- Medium5.31.2.9 - Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.31.2.9 - Missing Authorization
TrueBooker – Appointment Booking and Scheduler System
1.1.9 – 1.2.9Update to 1.3.0
- Medium5.3Missing Authorization
ElementsReady Addons for Elementor
≤6.7.2No patch available
- Medium5.3Unauthenticated Information Exposure
FormFlow for GoHighLevel (GHL) – Send Form Leads to GHL CRM
≤1.0.0Update to 1.0.1
- Medium5.3Unauthenticated Payment Bypass
iPOSpays Payment Gateway for WooCommerce
≤1.4.6Update to 1.4.7
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.7.8Update to 3.7.9
- Medium5.3Missing Authorization
2Way VideoCalls and Random Chat – HTML5 Webcam Videochat
≤6.1.5Update to 6.1.6
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Modern Events Calendar Lite
≤7.36.3Update to 7.36.4
- Medium4.3Authenticated (Subscriber+) Information Exposure
Modern Events Calendar Lite
≤7.36.0Update to 7.37.0
- Medium4.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium5.3Unauthenticated Negative Booking Total Creation
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium6.4Authenticated (Salon Staff+) Stored Cross-Site Scripting
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium4.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.10Update to 10.31.11
- Medium4.31.2.10 - Missing Authorization
Tasty Recipes Lite – WordPress Recipe Card Plugin with Built-In Recipe Schema
1.2 – 1.2.10Update to 1.2.11
- Medium4.7Unauthenticated Open Redirect
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
≤3.2.2Update to 3.2.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.29Update to 1.0.30
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
Fastcache by Host.it
≤1.7.5Update to 1.7.6
- Medium5.3Missing Authorization
ActiveTrail for WooCommerce
≤1.2.6Update to 1.2.7
- Medium5.3Missing Authorization
Gateway for Vantiv on WC
≤1.0.1No patch available
- Medium5.31.3.12 - Missing Authorization
BDM Digital Payment Gateway
1.2.7 – 1.3.12Update to 1.3.13
- High7.2Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
WP Sessions Time Monitoring Full Automatic
≤1.1.5Update to 1.1.6
- Medium5.4Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
Events Made Easy
≤3.2.22Update to 3.2.23
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.191Update to 2.8.192
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body
GoSMTP Pro
≤1.2.3Update to 1.2.4