Database
Critical WordPress vulnerabilities (page 1266)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Unprotected AJAX Actions
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium4.3Authenticated Arbitrary Post Deletion
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- High7.5Unauthenticated Arbitrary Nonce Generation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Critical9.8Arbitrary File Upload
Kaswara Modern VC Addons
≤3.0.1No patch available
- High8.8Authenticated PHP Object Injection
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.14Update to 1.7.15
- Medium6.1Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.2.4Update to 1.2.5
- Medium6.1Reflected Cross-Site Scripting
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.10.4Update to 1.10.5
- Medium6.1Multiple Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.69Update to 1.5.69
- Medium6.1Reflected Cross-Site Scripting
404 SEO Redirection
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting via tab Parameter
All 404 Redirect to Homepage
<1.21Update to 1.21
- High8.8Cross-Site Request Forgery
404 SEO Redirection
≤1.3Update to 1.4
- Medium4.8Authenticated Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤6.4Update to 7.1
- Medium6.4Stored Cross-Site Scripting
Clever Addons for Elementor
<2.1.0Update to 2.1.0
- High7.1XXE Injection
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- Medium6.5Sensitive Information Disclosure
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤4.1.9Update to 2.0.7 or 4.1.10
- High8.8Authenticated (Contributor+) Privilege Escalation
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤2.0.6Update to 2.0.7
- Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting
fitness calculators
≤1.9.5Update to 1.9.6
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤2.1.7Update to 2.2.0
- Medium5.4Contributor+ Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.3.1Update to 2.3.2
- Medium6.5Server-Side Request Forgery
Podcast Importer SecondLine
<1.1.5Update to 1.1.5
- Medium6.4Authenticated Stored Cross-Site Scripting
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
<1.8.6Update to 1.8.6
- Critical9.1Server-Side Request Forgery
WP Smart Import : Import any XML File to WordPress
<1.0.1Update to 1.0.1
- Medium5.4Premium Addons for Elementor <=4.2.7 Contributor+ Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
<4.2.8Update to 4.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rife Extensions & Templates for Elementor
<1.1.6Update to 1.1.6
- Medium6.4Contributor+ Stored Cross-Site Scripting
JetWidgets For Elementor
<1.0.9Update to 1.0.9
- Medium5.4Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤1.5.5Update to 1.5.7