Database
Critical WordPress vulnerabilities (page 126)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.38.7.5 - Missing Authorization
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
8.7.2 – 8.7.5Update to 8.7.6
- Medium4.3Missing Authorization
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.14Update to 2.0.15
- High7.210.3 - Unauthenticated Stored Cross-Site Scripting
YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin
10.0 – 10.3No patch available
- Medium5.3Unauthenticated Information Exposure
Zonify – Amazon Product Importer for WooCommerce
<1.0.5Update to 1.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤4.0.7Update to 4.0.8
- High7.5Unauthenticated Arbitrary File Read
Yogeta WP Cloud
≤1.0No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
YayPricing – WooCommerce Dynamic Pricing & Discounts
<3.5.7Update to 3.5.7
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- Medium6.35.2.7 - Authenticated (Subscriber+) Privilege Escalation
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
4.4.6 – 5.2.7Update to 5.2.8
- Medium4.3Authenticated (Subscriber+) Information Exposure
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
≤2.0.14Update to 2.0.15
- Medium5.3Unauthenticated Payment Bypass
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.23Update to 4.1.24
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Xpro Addons — 150+ Widgets for Elementor
≤1.7.8Update to 1.7.9
- Medium5.3Unauthenticated Insecure Direct Object Reference
Schema & Structured Data for WP & AMP
≤1.65Update to 1.66
- High7.5Unauthenticated SQL Injection
SAMO Forms
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Import Export Lite
≤3.9.32Update to 3.9.33
- Medium4.9Authenticated (Admin+) Arbitrary File Read
WP Import Export Lite
≤3.9.32Update to 3.9.33
- High7.2Authenticated (Admin+) Remote Code Execution
WP Import Export Lite
≤3.9.33Update to 3.9.34
- Medium4.3Cross-Site Request Forgery
Subscriptions for WooCommerce
≤2.0.2Update to 2.0.3
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
Add User Autocomplete
<1.2Update to 1.2
- Medium5.3Unauthenticated Information Exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.6Update to 4.4.7
- High7.3Unauthenticated Privilege Escalation
WP Component
≤2.2.4No patch available
- Medium4.34.0.7 - REST API Authentication Confusion
Tutor LMS – eLearning and online course solution
≤4.0.7Update to 4.0.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Hoo Companion
1.0.2 – 1.0.2No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
WP images upload on piclect
≤1.0No patch available
- High8.1Unauthenticated PHP Object Injection
IDB Ecommerce (wpStoreCart 5)
≤5.0.7No patch available
- Medium4.3Missing Authorization to 2FA Bypass
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
≤9.8.1Update to 9.8.2
- High7.2Unauthenticated Stored Cross-Site Scripting
BE REST Endpoints
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery
Export & Import WPBakery Page Builder
≤1.0.2No patch available
- High7.5Unauthenticated SQL Injection
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard
≤4.1.0Update to 4.2.0
- Medium6.3Authenticated (Custom Role+) Privilege Escalation
Booking for Appointments and Events Calendar – Amelia
<2.4.10Update to 2.4.10