Database
WordPress vulnerabilities listed in CISA KEV (page 7)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
- Medium5.3Missing Authorization
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Vidplex – Ultimate Video Gallery Block for YouTube in Gutenberg
≤1.0.3Update to 1.0.4
- Medium4.3Missing Authorization
Dropshipping XML Import for WooCommerce
≤1.7.4Update to 1.7.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Customer Area
≤8.4.3Update to 8.4.4
- Medium5.3Missing Authorization
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events
≤1.0.20Update to 1.0.21
- Medium4.3Cross-Site Request Forgery
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.5.90Update to 5.5.91
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤10.0.2Update to 10.0.3
- Medium4.3Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.2.2Update to 2.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HTML5 Video Player – embed fast, responsive videos with ease
≤2.14.1Update to 2.14.2
- Medium4.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.0Update to 5.3.1
- Medium5.3Missing Authorization
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.13.0Update to 2.13.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Spectra Legacy – Gutenberg Blocks
≤2.20.4Update to 2.20.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.71Update to 3.1.72
- Medium6.1Reflected Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.3Update to 1.10.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤5.0.0Update to 5.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.50Update to 1.15.51
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤8.10.6Update to 8.10.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Welcart e-Commerce
≤2.12.6Update to 2.12.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Checkout Files Upload for WooCommerce
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
≤1.4.128Update to 1.4.129
- Medium6.3Authenticated (Technician+) Privilege Escalation
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤4.1234Update to 4.1235
- High7.2Unauthenticated Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.5.56.7212Update to 7.5.57.7212
- High7.2Unauthenticated Stored Cross-Site Scripting
ACF Frontend Admin by DynamiApps
≤3.30.1Update to 3.30.2
- Medium5.3Unauthenticated Information Exposure
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Flying Images: Optimize and Lazy Load Images for Faster Page Speed
≤2.4.15Update to 2.4.16
- Medium6.1Reflected Cross-Site Scripting
WP Inventory Manager
≤2.5.9Update to 2.5.10
- Medium5.3Missing Authorization
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
≤2.6.1Update to 2.6.2
- Medium5.3Unauthenticated Information Exposure
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.15Update to 1.15.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Calendar
≤6.18.3Update to 6.18.3.1
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3