Database
WordPress vulnerabilities listed in CISA KEV (page 54)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter
Tainacan
≤1.3.0Update to 1.4.0
- Critical9.8Unauthenticated Arbitrary File Upload via IMAP Email Attachment
ELEX WordPress HelpDesk & Customer Ticketing System
≤3.3.7Update to 3.3.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field
SQL Chart Builder
≤3.0.6Update to 3.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Hide My WP Ghost – Security & Firewall
≤7.0.12Update to 7.0.13
- Medium6.1Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
Tutor LMS – eLearning and online course solution
≤4.0.8Update to 4.0.9
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
≤4.11.1Update to 4.11.2
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
SiteOrigin CSS
≤1.6.7Update to 1.6.8
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
SiteOrigin CSS
≤1.6.7Update to 1.6.8
- Medium5.3Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant
Lightweight Cookie Notice – Cookie Banner for Cookie Consent
≤1.19Update to 1.20
- High7.2Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter
Schema & Structured Data for WP & AMP
≤1.67Update to 1.68
- Medium6.1Reflected Cross-Site Scripting
PAYCOMET for WooCommerce
≤5.45Update to 5.46
- High7.2Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.9Update to 10.31.10
- High7.2Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
Simply Schedule Appointments
≤1.6.12.35Update to 1.6.12.37
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute
Quick PayPal Payments: Payment Button & Form
≤6.0.4Update to 6.0.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.1Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via First Name Field
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.3Update to 4.0.4
- High8.8Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
PilotPress
≤2.0.43Update to 2.0.44
- High7.2Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.3Update to 3.3.4
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
≤1.9.2.1Update to 1.10.0
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
≤1.9.2.1Update to 1.10.0
- Critical9.8Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
My Calendar – Accessible Event Manager
≤3.8.7Update to 3.4.25 or 3.5.22 or 3.6.18 or 3.7.18 or 3.8.8
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.3Update to 3.3.4
- High7.5Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
≤4.7.11Update to 4.7.12
- High8.1Unauthenticated Authentication Bypass via Delay OTP Grace State
miniOrange OTP Login, Verification and SMS Notifications
≤5.5.8Update to 5.6.0
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.11Update to 3.0.12
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
Mang Board
≤2.4.4Update to 2.4.5
- High7.2Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX
Mang Board
≤2.4.3Update to 2.4.4
- Critical9.8Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
≤1.2.78.6Update to 1.2.78.7
- Critical9.82.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
Mang Board
2.4.4 – 2.4.4Update to 2.4.5