Database
WordPress vulnerabilities listed in CISA KEV (page 9)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.12Update to 4.4.13
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Site Reviews
≤8.3.6Update to 8.3.7
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.1Update to 5.3.2
- Medium5.3Missing Authorization
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
≤2.6.1Update to 2.6.2
- Medium4.3Missing Authorization
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.5.0Update to 2.6.0
- Medium6.1Reflected Cross-Site Scripting
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
≤3.1.4Update to 3.1.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.71Update to 3.1.72
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.7Update to 4.18.0
- Medium4.3Cross-Site Request Forgery
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Invoice Gateway for WooCommerce – Invoice Payment Gateway
≤1.1.6Update to 1.1.7
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.6Update to 3.3.7
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Customize WordPress Emails and Alerts – Better Notifications for WP
≤1.10.1Update to 1.10.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Welcart e-Commerce
≤2.12.6Update to 2.12.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.5Update to 4.3.6
- High7.3Unauthenticated Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.7Update to 4.18.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
≤3.21.2Update to 4.0.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
The Events Calendar
≤6.18.3Update to 6.18.3.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
JetFormBuilder – Hierarchical Select
≤1.0.10Update to 1.0.11
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Cool FormKit Lite – Advanced Form Builder for Elementor
≤2.7.10Update to 2.7.11
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.6Update to 2.1.7
- Medium5.3Unauthenticated CAPTCHA Protection Bypass on Login
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.4Update to 1.44.5
- Medium5.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.2.20Update to 2.2.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Post Fields for Contact Form 7
≤2.6.0Update to 2.7.1
- Medium4.3Missing Authorization
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]
Download Manager
6.0.0 – 7.5.9Update to 7.6.4
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action
Checkout Field Editor for WooCommerce (Pro)
≤3.8.0Update to 3.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Quttera ThreatSign – Web Malware Scanner for WordPress
≤4.1.0.48Update to 4.1.0.49