Database
Critical WordPress vulnerabilities (page 100)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Virtue/Ascend/Pinnacle Toolkit
≤4.9.12.1Update to 4.9.12.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
EWWW Image Optimizer
≤8.7.7Update to 8.8.0
- Medium6.5Authenticated (Contributor+) SQL Injection
BuildKit – Product Builder for WooCommerce – Custom PC Builder
≤1.0.28Update to 1.0.29
- Medium6.5Authenticated (Contributor+) SQL Injection
Pricing Table WordPress Plugin – Easy Pricing Tables
≤4.1.2Update to 4.1.3
- Medium4.3Missing Authorization
Motors – Car Dealership & Classified Listings Plugin
≤1.4.123Update to 1.4.124
- Medium4.9Authenticated (Administrator+) SQL Injection
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.27Update to 6.4.28
- Medium6.3Authenticated (Subscriber+) Free Paid Course Enrollment
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators
≤1.2.19Update to 1.2.20
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce
≤1.14.11Update to 1.14.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Qi Addons For Elementor
≤1.11Update to 1.11.1
- Medium6.1Reflected Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.1Update to 3.13.2
- High7.2Authenticated (Shop Manager+) Arbitrary CSS Injection
Astra
≤4.13.12Update to 4.14.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
≤2.5.63Update to 2.5.64
- Medium4.7Unauthenticated Open Redirect
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
≤1.12.26Update to 1.12.27
- Medium5.3Unauthenticated Information Exposure
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤4.2.3Update to 4.2.4
- Medium4.3Cross-Site Request Forgery
Razorpay Payment Links for WooCommerce
≤2.1.5Update to 2.2.0
- Medium6.5Authenticated (Contributor+) SQL Injection
Media Library Assistant
≤3.41Update to 3.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP OAuth Server (OAuth Authentication)
≤4.5.1Update to 4.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Strong Testimonials
≤3.3.11Update to 3.3.12
- Medium5.3Unauthenticated Insecure Direct Object Reference
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
≤3.1.0Update to 3.1.1
- Medium4.3Missing Authorization
Prevent Files / Folders Access
≤2.6.7Update to 2.6.8
- Medium4.34.22.0 - Authenticated (Subscriber+) Payment Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
4.21.1 – 4.22.0Update to 4.22.1
- Medium6.5Authenticated (Author+) SQL Injection
Quiz Cat – WordPress Quiz Plugin
≤3.1.1Update to 3.2.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium6.4Authenticated (Listing Manager+) Stored Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
≤1.4.123Update to 1.4.124
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20260810Update to 20260916
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.23.1Update to 3.50.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.105Update to 4.11.106
- Medium4.9Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
WPML Multilingual & Multicurrency for WooCommerce
≤5.5.7Update to 5.5.8
- Medium4.3Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
≤1.21.0Update to 1.21.1