Database
Critical WordPress vulnerabilities (page 125)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
≤1.2.7Update to 1.2.8
- Medium4.3Missing Authorization
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Information Exposure
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard
≤4.1.0Update to 4.2.0
- High8.8Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
Consulting - Business, Finance WordPress Theme
≤6.7.16Update to 6.7.17
- Medium4.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium5.4Unauthenticated Open Redirect
Newsletter
≤9.3.6Update to 9.3.7
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium4.3Authenticated (Board Member+) Comment Author Spoofing
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.14Update to 2.0.15
- Medium5.3Unauthenticated Insecure Direct Object Reference
kboard
≤6.6Update to 6.7
- Medium5.3Unauthenticated Information Exposure
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
≤1.2.7Update to 1.2.8
- Medium5.3Unauthenticated Information Exposure
Subscriptions for WooCommerce
≤2.0.2Update to 2.0.3
- Medium5.3Missing Authorization
Rox Appointment Booking – Event, Calendar & Appointment Scheduling
<1.2.0Update to 1.2.0
- Medium4.3Authenticated (Subscriber+) Full Admin Area Denial of Service
Seraphinite Accelerator
≤2.29.23Update to 2.29.24
- Medium5.3Unauthenticated Appointment Slot Capacity Bypass
Appointment Hour Booking – Booking Calendar
≤1.5.94Update to 1.5.95
- Medium6.1Reflected Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium5.3Unauthenticated Content Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.34Update to 6.35
- Medium4.3Authenticated (Subscriber+) Information Exposure
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- High7.3Unauthenticated Privilege Escalation
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.8.0Update to 4.16.8.1
- Medium4.3Cross-Site Request Forgery
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.3Update to 4.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.11Update to 4.2.12
- High7.5Unauthenticated SQL Injection
Album Cover Finder
≤0.7.0No patch available
- Medium5.3Unauthenticated Information Exposure
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66
- Critical9.8Unauthenticated Arbitrary File Upload
DS Ad Rotator
≤0.8No patch available
- Medium6.3Authenticated (Author+) Privilege Escalation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
<5.2.8Update to 5.2.8
- Medium5.5Authenticated (Administrator+) Server-Side Request Forgery
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.9Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.21.5.34 - Unauthenticated Stored Cross-Site Scripting
GenieWords
1.5.27 – 1.5.34No patch available
- Critical9.8Unauthenticated Remote Code Execution via Dynamic Render Field Type
Advanced Custom Fields: Extended PRO
≤0.9.2.6Update to 0.9.2.7