Database
WordPress vulnerabilities listed in CISA KEV (page 8)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
- Medium5.3Missing Authorization
Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder
≤4.0.1Update to 4.0.2
- Medium5.3Missing Authorization
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.3.0Update to 3.3.1
- Medium4.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.12.0Update to 2.12.1
- Medium4.3Missing Authorization
Media Library Assistant
≤3.43Update to 3.44
- Medium4.3Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
≤1.21.6Update to 1.21.7
- Medium5.3Missing Authorization
MoreConvert Wishlist for WooCommerce
≤2.0.3Update to 2.0.4
- Medium4.3Missing Authorization
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.3Update to 4.3.4
- Medium5.3Missing Authorization
Premium Blocks – Gutenberg Blocks, Patterns & Templates
≤2.3.18Update to 2.3.19
- Medium4.3Missing Authorization
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MoreConvert Wishlist for WooCommerce
≤2.0.3Update to 2.0.4
- Medium5.3Missing Authorization
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.5.0Update to 2.6.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Recipe Maker
≤10.9.1Update to 10.9.2
- Medium4.3Missing Authorization
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Vendor+) Stored Cross-Site Scripting
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.3Update to 3.8.4
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤4.0.2Update to 4.0.3
- Medium4.3Cross-Site Request Forgery
Wp Social Login and Register Social Counter
≤3.2.3Update to 3.2.4
- Medium4.3Missing Authorization
VOD Infomaniak
≤1.5.15Update to 1.5.16
- Medium5.3Missing Authorization
WP-Lister Lite for Amazon
≤2.9.2Update to 2.9.2.5
- Medium5.3Unauthenticated Information Exposure
YITH WooCommerce Subscription
≤4.22.0Update to 4.23.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter
Subscribe2 – Form, Email Subscribers & Newsletters
≤10.47Update to 10.48
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter
Flipbox – Awesomes Flip Boxes Image Overlay
≤3.1.1Update to 3.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.5Update to 2.1.6
- Medium4.3Missing Authorization
Meta Box – A Framework for Dynamic Websites
≤5.15.3Update to 5.15.4
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤3.3.0Update to 3.3.1
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Exeuction
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.56Update to 3.7.57
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.26Update to 2.0.28
- Medium4.3Authenticated (Subscriber+) Brute-Force Lockout Bypass
WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection
≤3.6.2Update to 3.6.3
- Medium4.3Cross-Site Request Forgery
Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More
≤4.2.4Update to 4.2.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Media Library Assistant
≤3.43Update to 3.44
- Medium6.1Reflected Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.14Update to 7.3.15