Database
Critical WordPress vulnerabilities (page 115)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.9.34Update to 5.9.35
- Medium4.3Authenticated (Subscriber+) Information Exposure
Zportals
≤6.4.1Update to 6.4.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Newsletters
≤4.18.0Update to 4.18.1
- Medium5.3Unauthenticated IP Spoofing to Protection Bypass
Divi Dash
≤1.0.6Update to 1.0.7
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.3Update to 5.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.49.0Update to 3.50.0
- Medium4.36.17.4.1 - Missing Authorization
The Events Calendar
6.15.16.1 – 6.17.4.1Update to 6.17.5
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Missing Authorization
Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification
≤2.10.3Update to 2.10.4
- Medium4.35.7.2 - Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
5.3.6 – 5.7.2Update to 5.7.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar
≤2.1.20Update to 2.1.21
- Medium5.3Unauthenticated Payment Bypass
Paymob for WooCommerce
≤4.1.13Update to 4.1.14
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Post Meta Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.57.2.0Update to 1.57.2.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Ninja Tables – Responsive Table Builder for Data, Pricing & Product Tables
≤5.2.16Update to 5.2.17
- Medium4.3Authenticated (Subscriber+) Information Exposure
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium5.3Missing Authorization
Social Commerce for WooCommerce
≤2.5.4No patch available
- Medium5.31.2.5 - Unauthenticated Information Exposure
Lightbox
1.2.2 – 1.2.5No patch available
- Medium5.3Missing Authorization
E-cab Taxi Booking Manager for Woocommerce
<2.0.8Update to 2.0.8
- Critical9.8Unauthenticated Arbitrary File Upload
Web to Print Online Designer
≤2.14.0Update to 2.15.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Partial Shipment for WooCommerce
≤3.4Update to 3.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
Gum Addon for Elementor
≤1.3.15Update to 1.3.16
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action
Empik for Woocommerce
≤1.5.1Update to 1.5.2
- Medium5.3Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints
WordLift – AI powered SEO – Schema
≤3.54.10Update to 3.54.14
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
Redux Framework
≤4.5.13Update to 4.5.14
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
Datalogics Ecommerce Delivery – Datalogics
≤2.6.65Update to 2.6.66
- Medium5.3Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
TikTok
≤1.4.1Update to 1.4.2
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
YS LeadGen – Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation
≤2.1.4Update to 2.1.5
- Medium4.7Reflected Cross-Site Scripting via ESI 'esi' Parameter
LiteSpeed Cache
≤7.9Update to 7.9.1
- High7.5Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
YS LeadGen – Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation
≤2.1.4Update to 2.1.5