Database
Critical WordPress vulnerabilities (page 1262)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24387 | — | |
| Critical9.8 | Local File Inclusion | CVE-2021-24375 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24432 | — | |
| High8.8 | Authenticated Remote Command Execution | CVE-2015-7806 | — | |
| Medium4.3 | Cross-Site Request Forgery Bypass | CVE-2021-4410 | — | |
| Medium4.3 | Cross-Site Request Forgery Bypass | CVE-2021-4412 | — | |
| Medium4.3 | Multiple Roles <= 1.3.1- Cross-Site Request Forgery Bypass | CVE-2021-4402 | — | |
| Medium4.3 | Cross-Site Request Forgery Bypass | CVE-2021-4418 | — | |
| Critical9.8 | Object Injection | CVE-2021-24384 | — | |
| High8.8 | Arbitrary File Upload to Remote Code Exectution | CVE-2021-4382 | — | |
| Medium5.3 | Add Like/Dislike Bypass | CVE-2021-24379 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24373 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2021-24382 | — | |
| Medium6.1 | Newspaper Magazine News BuddyPress AMP < 5.4.4 - Reflected Cross-Site Scripting | CVE-2021-24364 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2021-24383 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24372 | — | |
| Critical9.8 | wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution | CVE-2020-24186 | — | |
| Critical9.8 | SQL Injection | CVE-2021-24361 | — | |
| Critical9.8 | 2.1.2 - Arbitrary Options Change | CVE-2021-4362 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24368 | — | |
| High8.8 | SQL Injection | CVE-2021-24520 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2021-24369 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2021-24370 | — | |
| Medium5.3 | Information Disclosure Jetpack – AI Agents & MCP, Security, Backup & Analytics<9.7.1Update to 2.0.8 or 2.1.6 or 2.2.9 or 2.3.9 or 2.4.6 or 2.5.4 or 2.6.5 or 2.7.4 or 2.8.4 or 2.9.5 or 3.0.5 or 3.1.4 or 3.2.4 or 3.3.5 or 3.4.5 or 3.5.5 or 3.6.3 or 3.7.4 or 3.8.4 or 3.9.8 or 4.0.5 or 4.1.2 or 4.2.3 or 4.3.3 or 4.4.3 or 4.5.1 or 4.6.1 or 4.7.2 or 4.8.3 or 4.9.1 or 5.0.1 or 5.1.2 or 5.2.3 or 5.3.2 or 5.4.2 or 5.5.3 or 5.6.3 or 5.7.3 or 5.8.2 or 5.9.2 or 6.0.2 or 6.1.3 or 6.2.3 or 6.3.5 or 6.4.4 or 6.5.2 or 6.6.3 or 6.7.2 or 6.8.3 or 6.9.2 or 7.0.3 or 7.1.3 or 7.2.3 or 7.3.3 or 7.4.3 or 7.5.5 or 7.6.2 or 7.7.4 or 7.8.2 or 7.9.2 or 8.0.1 or 8.1.2 or 8.2.4 or 8.3.1 or 8.4.3 or 8.5.1 or 8.6.2 or 8.7.2 or 8.8.3 or 8.9.2 or 9.0.3 or 9.1.1 or 9.2.2 or 9.3.3 or 9.4.2 or 9.5.3 or 9.6.2 or 9.7.1 | CVE-2021-24374 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2021-24357 | — | |
| Medium5.4 | Admin Columns Free < 4.3 and Pro < 5.5.1 Stored Cross-Site Scripting | CVE-2021-24366 | — | |
| Medium6.1 | Open Redirect | CVE-2021-24358 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2021-24367 | — | |
| Medium5.3 | Open Redirect | CVE-2021-24359 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24351 | — |
- Medium6.1Reflected Cross-Site Scripting
Real Estate 7 WordPress
<3.1.1Update to 3.1.1
- Critical9.8Local File Inclusion
Motor – Cars, Parts, Service, Equipments and Accessories WooCommerce Store
<3.1.0Update to 3.1.0
- Medium6.1Reflected Cross-Site Scripting
Advanced AJAX Product Filters
≤1.5.4.6Update to 1.5.4.7
- High8.8Authenticated Remote Command Execution
Form Manager
<1.7.3Update to 1.7.3
- Medium4.3Cross-Site Request Forgery Bypass
Qtranslate Slug
≤1.1.18No patch available
- Medium4.3Cross-Site Request Forgery Bypass
WP Prayer
≤1.6.5Update to 1.6.6
- Medium4.3Multiple Roles <= 1.3.1- Cross-Site Request Forgery Bypass
Multiple Roles
≤1.3.1Update to 1.3.2
- Medium4.3Cross-Site Request Forgery Bypass
Custom css-js-php
≤2.0.7No patch available
- Critical9.8Object Injection
JoomSport – for Sports: Team & League, Football, Hockey & more
<5.1.8Update to 5.1.8
- High8.8Arbitrary File Upload to Remote Code Exectution
Recently
≤3.0.4Update to 3.0.5
- Medium5.3Add Like/Dislike Bypass
Comments Like Dislike
<1.1.4Update to 1.1.4
- Medium6.1Reflected Cross-Site Scripting
WP Hardening (discontinued)
<1.2.2Update to 1.2.2
- Medium5.4Authenticated Stored Cross-Site Scripting
Smart Slider 3
<3.5.0.9Update to 3.5.0.9
- Medium6.1Newspaper Magazine News BuddyPress AMP < 5.4.4 - Reflected Cross-Site Scripting
Jannah - Newspaper Magazine News BuddyPress AMP
<5.4.4Update to 5.4.4
- Medium5.4Authenticated Stored Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<8.1.12Update to 8.1.12
- Medium6.1Reflected Cross-Site Scripting
WP Hardening (discontinued)
≤1.2.1Update to 1.2.2
- Critical9.8wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution
Comments – wpDiscuz
7.0 – 7.0.4Update to 7.0.5
- Critical9.8SQL Injection
Location Manager
<2.1.0.10Update to 2.1.0.10
- Critical9.82.1.2 - Arbitrary Options Change
Social Sharing Plugin – Kiwi
2.1.0 – 2.1.2Update to 2.1.3
- Medium6.1Reflected Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.1.17Update to 7.1.18
- High8.8SQL Injection
Stock in & out
≤1.0.4No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.3.3Update to 2.3.4
- Critical9.8Unauthenticated Arbitrary File Upload
Fancy Product Designer
<4.6.9Update to 4.6.9
- Medium5.3Information Disclosure
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<9.7.1Update to 2.0.8 or 2.1.6 or 2.2.9 or 2.3.9 or 2.4.6 or 2.5.4 or 2.6.5 or 2.7.4 or 2.8.4 or 2.9.5 or 3.0.5 or 3.1.4 or 3.2.4 or 3.3.5 or 3.4.5 or 3.5.5 or 3.6.3 or 3.7.4 or 3.8.4 or 3.9.8 or 4.0.5 or 4.1.2 or 4.2.3 or 4.3.3 or 4.4.3 or 4.5.1 or 4.6.1 or 4.7.2 or 4.8.3 or 4.9.1 or 5.0.1 or 5.1.2 or 5.2.3 or 5.3.2 or 5.4.2 or 5.5.3 or 5.6.3 or 5.7.3 or 5.8.2 or 5.9.2 or 6.0.2 or 6.1.3 or 6.2.3 or 6.3.5 or 6.4.4 or 6.5.2 or 6.6.3 or 6.7.2 or 6.8.3 or 6.9.2 or 7.0.3 or 7.1.3 or 7.2.3 or 7.3.3 or 7.4.3 or 7.5.5 or 7.6.2 or 7.7.4 or 7.8.2 or 7.9.2 or 8.0.1 or 8.1.2 or 8.2.4 or 8.3.1 or 8.4.3 or 8.5.1 or 8.6.2 or 8.7.2 or 8.8.3 or 8.9.2 or 9.0.3 or 9.1.1 or 9.2.2 or 9.3.3 or 9.4.2 or 9.5.3 or 9.6.2 or 9.7.1
- Medium6.4Stored Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
<2.0.35Update to 2.0.35
- Medium5.4Admin Columns Free < 4.3 and Pro < 5.5.1 Stored Cross-Site Scripting
Admin Columns
≤4.2Update to 4.3
- Medium6.1Open Redirect
The Plus Addons for Elementor Page Builder Pro
<4.1.10Update to 4.1.10
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Config File Editor
≤1.7.1No patch available
- Medium5.3Open Redirect
The Plus Addons for Elementor Page Builder Pro
<4.1.11Update to 4.1.11
- Medium6.1Reflected Cross-Site Scripting
The Plus Addons for Elementor Page Builder Pro
<4.1.12Update to 4.1.12