Database
WordPress vulnerabilities listed in CISA KEV (page 68)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Unauthenticated Arbitrary File Read via 'f' Parameter
Music Store – WordPress eCommerce
≤1.4.7Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤5.14.2Update to 5.15
- High8.8Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
≤10.2.1Update to 10.3.0
- High8.8Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.3Update to 5.7.4
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.2Update to 5.7.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.12Update to 3.7.12.1
- Medium4.7Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.6Update to 3.6.6.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.31Update to 1.7.32
- High8.1Unauthenticated Privilege Escalation to Support User Identity Confusion
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.8.3Update to 4.9
- High8.8Authenticated (Custom+) Privilege Escalation to 'user' Parameter
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9Update to 4.9.1
- Low3.1Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot
≤2.4.89Update to 2.4.90
- Low3.1Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot
≤2.4.89Update to 2.4.90
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- High8.1Unauthenticated Local File Inclusion via 'design_type' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.187Update to 2.8.188
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
FV Player 8
≤8.1.7Update to 8.1.8
- High8.8Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
FooSales – Point of Sale (POS) for WooCommerce
≤1.43.0Update to 1.43.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
Church Admin
≤5.1.2Update to 5.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
Getwid – Gutenberg Blocks
≤3.0.1Update to 3.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
Table Field Add-on for ACF and SCF
≤1.3.35Update to 1.3.40
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
≤2.7.13Update to 2.7.14
- Medium5.3Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
Booking Calendar
≤11.4.3Update to 11.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
Graphene
≤2.9.4Update to 2.9.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
Real Estate Manager – Property Listing and Agent Management
≤7.3Update to 7.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
Brizy – Page Builder
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.12.03Update to 1.12.04
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤7.9.4Update to 7.9.5
- High7.2Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.6.9Update to 3.6.9.1
- Medium6.1Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
Download Manager
≤3.3.57Update to 3.3.58
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
Download Manager
≤3.3.58Update to 3.3.59
- Medium5.3Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
Simply Schedule Appointments
≤1.6.11.11Update to 1.6.12.0