Database
Critical WordPress vulnerabilities
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header
EZ SQL Reports Shortcode Widget and DB Backup
≤5.25.25Update to 5.26.45
- Critical9.8Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
Chatterbug Forms – Fast, Flexible WordPress Form Builder
≤1.0.2Update to 1.1
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
ELEX WordPress HelpDesk & Customer Ticketing System
≤3.3.9Update to 3.4.0
- Medium5.3Unauthenticated Sensitive Information Exposure in 'search' Parameter
Customer Reviews for WooCommerce
≤5.127.0Update to 5.128.0
- High8.2Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter
Drag and Drop File Upload for Elementor Forms
≤1.6.2Update to 1.6.3
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta
Newsletters
≤4.18.2Update to 4.18.3
- Medium6.5Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute
Easy Property Listings
≤3.5.28Update to 3.5.29
- Low2.7Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter
WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups
≤4.19.0Update to 4.20.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters
WPZOOM Addons for Elementor – Starter Templates & Widgets
≤1.4.20Update to 1.4.21
- Medium4.9Authenticated (Editor+) SQL Injection via 'sourceId' Parameter
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping
≤2.24.1Update to 2.24.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter
WPeMatico RSS Feed Fetcher
≤2.9.1Update to 2.9.2
- High8.8Authenticated (Contributor+) Code Injection via 'post_content' Parameter
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets
≤4.2.6.1Update to 4.2.7
- High8.8Authenticated (Custom+) Privilege Escalation to /suredash/v1/save-settings REST Endpoint
SureDash – Community, Courses & Member Dashboard
≤1.13.0Update to 1.13.1
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- High8.1Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.5.5Update to 4.5.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
Recipe Card Blocks Lite
≤3.7.0Update to 3.7.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'qpages' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.9Update to 11.3.0
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via [honeypot] Form-Tag Placeholder Value
CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)
≤3.8.0Update to 3.9.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter
Download Manager
6.0.0 – 7.6.3Update to 7.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter
Passster – Password Protect Pages and Content
≤4.3.21Update to 4.3.22
- High8.8Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()
VibeBP
≤1.9.9.8.1Update to 1.9.9.8.2
- High8.8Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint
CourseCure Courses
≤1.5.1Update to 1.5.3
- High8.8Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Masterstudy - Education WordPress Theme
≤4.8.151Update to 4.8.152
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'
WP Table Builder – Drag & Drop Table Builder
≤2.1.7Update to 2.1.8
- Critical9.1File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'
Ninja Forms - File Uploads
≤3.3.36Update to 3.3.37
- Medium5.3Missing Authorization
Passster – Password Protect Pages and Content
≤4.3.20Update to 4.3.21
- Medium4.3Cross-Site Request Forgery
vdperanto
≤2.2No patch available
- Medium4.3Cross-Site Request Forgery
VISeek – Easy Custom Search
≤1.0.5Update to 1.0.6
- Medium5.3Unauthenticated Information Exposure
Security For WooCommerce
≤1.0.16No patch available
- Medium5.3Unauthenticated Information Exposure
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.3Update to 3.1.4