Database
Critical WordPress vulnerabilities (page 118)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Low2.7Authenticated (Admin+) Insecure Direct Object Reference
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.0Update to 4.5.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset
VW Writer Blog
≤1.3.8Update to 1.3.9
- High7.2Authenticated (Admin+) Privilege Escalation
Import and export users and customers
≤2.5.1Update to 2.5.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.8Update to 4.16.9
- Medium6.46.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
Kirki – Freeform Page Builder, Website Builder & Customizer
6.0.0 – 6.3.0Update to 6.3.1
- High7.3Unauthenticated Privilege Escalation
SAML Single Sign On – SSO Login
≤5.4.7Update to 6.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.24.0Update to 1.25.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
≤3.2.16Update to 3.2.17
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
WP Recipe Maker
≤10.8.1Update to 10.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.24.0Update to 1.25.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex
Complianz GDPR/CCPA Cookie Consent Banner
≤7.5.4Update to 7.5.5
- High8.1Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤3.2.2Update to 3.2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields
CSS & JavaScript Toolbox
≤12.0.6Update to 12.0.7
- Medium6.5Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.44Update to 1.8.45
- High7.5Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter
WP Multi Store Locator Pro
≤4.5.1Update to 4.5.2
- Medium6.1Reflected Cross-Site Scripting via Query-String Parameter Name
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤3.5.1Update to 3.5.2
- High8.8Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter
Mapster WP Maps
≤1.23.0Update to 1.24.0
- Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.3Update to 5.6.4
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
FileBird – WordPress Media Library Folders & File Manager
≤6.5.6Update to 6.5.7
- High7.5Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters
Location Manager
≤2.3.38Update to 2.3.39
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
Kubio AI Page Builder
≤2.8.4Update to 2.8.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.0Update to 9.3.1
- Medium6.5Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute
WP Inventory Manager
≤2.5.1Update to 2.5.2
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.5.0Update to 4.5.1
- Medium4.9Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
≤2.8.0Update to 2.8.1
- High7.5Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.2Update to 3.8.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
VK All in One Expansion Unit
≤9.118.0Update to 9.119.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
Strong Testimonials
≤3.3.8Update to 3.3.9
- Medium6.1Reflected DOM-Based Cross-Site Scripting via 's' Parameter
Qi Addons For Elementor
≤1.11Update to 1.11.1
- High7.5Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
Printcart Store – Web to Print Product Designer for WooCommerce
≤2.8.5Update to 2.8.6