Database
Critical WordPress vulnerabilities (page 111)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium4.9Authenticated (Administrator+) SQL Injection
Admin Notices Manager
≤1.6.0Update to 1.6.1
- Medium4.9Authenticated (Administrator+) SQL Injection
Estatik Real Estate Plugin
≤4.3.5Update to 4.3.6
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.11Update to 4.3.12
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Safe SVG
≤2.5.0Update to 2.5.1
- Medium5.3Unauthenticated Login Captcha Protection Bypass
Captcha Code
≤3.32Update to 3.33
- High7.2Unauthenticated Server-Side Request Forgery
Link Library
≤7.9.5Update to 7.9.6
- Medium4.3Authenticated (Contributor+) Path Traversal
Link Library
≤7.9.5Update to 7.9.6
- Medium5.3Missing Authorization
Netgsm
≤2.10.0Update to 2.10.2
- Medium4.9Authenticated (Administrator+) SQL Injection
Simple Discount Rules for Woocommerce
≤5.18Update to 5.19
- Medium6.5Authenticated (Author+) SQL Injection
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.17.9Update to 1.17.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Safe SVG
≤2.5.0Update to 2.5.1
- High7.5Unauthenticated SQL Injection
Bluff Post
≤1.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Link Library
≤7.9.5Update to 7.9.6
- Medium5.3Unauthenticated Information Exposure
Team Members
≤9.2Update to 9.3
- High7.5Unauthenticated SQL Injection via 'log' (Username) Parameter
Rename wp-login.php to anything you want
≤2.0.1No patch available
- Medium6.5Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode
Advanced Contact form 7 DB
≤2.1.1Update to 2.1.2
- Medium5.3Unauthenticated Information Exposure
TrustedLogin Connector
≤2.0.3Update to 2.0.4
- Medium5.32.0.1.1 - Missing Authorization
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
1.8.8.2 – 2.0.1.1Update to 2.0.2
- Medium5.3Missing Authorization
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.33.0Update to 2.34.0
- High8.1KEVPoCUnauthenticated Local File Inclusion via locate_template() Path Traversal
WordPress
≤7.1.1Update to 4.7.37 or 4.8.32 or 4.9.33 or 5.0.29 or 5.1.26 or 5.2.28 or 5.3.25 or 5.4.23 or 5.5.22 or 5.6.21 or 5.7.19 or 5.8.17 or 5.9.18 or 6.0.16 or 6.1.14 or 6.2.13 or 6.3.12 or 6.4.12 or 6.5.12 or 6.6.9 or 6.7.9 or 6.8.10 or 6.9.9 or 7.0.6 or 7.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultra Addons for Contact Form 7
≤3.5.50Update to 3.5.51
- Medium5.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.19Update to 2.9.20
- Medium4.37.4.4 - Authenticated (Subscriber+) Information Exposure
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
7.4.1 – 7.4.4Update to 7.4.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.4Update to 7.4.5
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.71Update to 2.1.72
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPeMatico RSS Feed Fetcher
≤2.8.25Update to 2.8.26
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
WPeMatico RSS Feed Fetcher
≤2.8.25Update to 2.8.26
- Medium5.3Missing Authorization to Account Registration
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50