Database
Critical WordPress vulnerabilities (page 1267)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated Stored Cross-Site Scripting
DethemeKit for Elementor
<1.5.5.5Update to 1.5.5.5
- Medium6.4Stored Cross-Site Scripting
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder
<1.5.8Update to 1.5.8
- Medium5.4Livemesh Addons for Elementor <= 6.7.1- Contributor+ Stored Cross-Site Scripting
Livemesh Addons by Elementor
≤6.7.1Update to 6.8
- Medium5.4Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<4.5.4Update to 4.5.4
- High8.1Directory Traversal to Arbitrary File Deletion and Denial of Service
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- Medium5.3Server-Side Request Forgery
WP-DownloadManager
<1.68.5Update to 1.68.5
- Medium6.4Authenticated Stored Cross-Site Scripting
Image Hover Effects – Elementor Addon
<1.3.4Update to 1.3.4
- Medium5.4Stored Cross-Site Scripting
Sina Extension for Elementor
<3.3.12Update to 3.3.12
- Medium5.4Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤1.5.5Update to 1.5.7
- Medium6.4Authenticated Stored Cross-Site Scripting
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
<1.8.6Update to 1.8.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rife Extensions & Templates for Elementor
<1.1.6Update to 1.1.6
- Medium5.4Premium Addons for Elementor <=4.2.7 Contributor+ Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
<4.2.8Update to 4.2.8
- Critical9.1Server-Side Request Forgery
WP Smart Import : Import any XML File to WordPress
<1.0.1Update to 1.0.1
- Medium6.4Contributor+ Stored Cross-Site Scripting
JetWidgets For Elementor
<1.0.9Update to 1.0.9
- High7.5Directory Traversal
Video Downloader for TikTok
<1.4Update to 1.4
- Critical9.1Server-Side Request Forgery
Import XML and RSS Feeds
<2.0.3Update to 2.0.3
- High8.6Directory Traversal
Media File Organizer
≤1.0.1No patch available
- High8.8Cross-Site Request Forgery to Arbitrary Listing Export
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2
- Medium4.3Cross-Site Request Forgery to Arbitrary Payment History Update
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2
- Medium6.5Cross-Site Request Forgery to Stored Cross-Site Scripting
Content Copy Protection & Prevent Image Save
≤1.3No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WP Super Cache
<1.7.3Update to 1.7.3
- Medium5.4Authenticated Stored Cross-Site Scripting
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11.1Update to 5.11.2
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.10.1Update to 5.11
- High8.8Cross-Site Request Forgery
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11Update to 5.11.1
- High7.2Authenticated PHP4 Upload
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤5.11Update to 5.11.1
- High7.2Arbitrary File Upload
College publisher Import
≤0.1No patch available
- High8.8Arbitrary File Upload
classyfrieds
≤3.8No patch available
- High7.2Cross-Site Request Forgery
Event Banner
≤1.3No patch available
- Medium6.4Authenticated (Subscriber+) Cross-Site Scripting
Contact Form Check Tester
≤1.0.2No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Larsens Calender
≤1.2No patch available