Database
Critical WordPress vulnerabilities (page 1271)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
Better Search – Relevant search results for WordPress
≤2.5.2Update to 2.5.3
- Medium5.4Reflected Cross-Site Scripting
File Manager
<7.1Update to 7.1
- Medium6.1Reflected Cross-Site Scripting
NextGen Gallery Pro
≤3.1.9Update to 3.1.11
- High7.5API Key Disclosure
Web-Stat – Live Visitor Analytics
≤1.4.0Update to 1.4.1
- Medium6.4Cross-Site Scripting
Advanced Order Export For WooCommerce
≤3.1.7Update to 3.1.8
- Critical9.8Arbitrary File Creation
QuadMenu – Mega Menu
≤2.0.6Update to 2.0.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Testimonial Rotator
≤3.0.3No patch available
- High7.2Authenticated Arbitrary File Upload
JetBackup – Backup, Restore & Migrate
≤1.5.9Update to 1.6.0
- Medium6.1Administrator Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- High8.8Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium4.3Authenticated OAuth Connection Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34.1Update to 3.4.34.1
- Medium5.4Cross-Site Request Forgery to OAuth Service Disconnection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium4.9Authenticated Arbitrary File Download
Theme Editor
≤2.5Update to 2.6
- Medium6.1Directory & Listings With Booking - WordPress Theme < 1.6.11 - Cross-Site Scripting
Listeo - Directory & Listings With Booking - WordPress Theme
<1.6.11Update to 1.6.11
- Medium6.1Tour & Travel WordPress Theme < 2.0 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.0Update to 2.0
- High8.8Cross-Site Request Forgery to Setting Modification
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- High8.84.0.3 - Authenticated Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
4.0 – <4.0.4Update to 4.0.4
- Critical9.6WP Armour Honeypot Anti Spam <= 1.5.6 -Cross-Site Request Forgery to Arbitrary Options Update
WP Armour – Honeypot Anti Spam
<1.5.7Update to 1.5.7
- High7.5Server-Side Request Forgery
Like Button Rating ♥ LikeBtn
<2.6.32Update to 2.6.32
- Medium6.1Social Directory WordPress Theme <= 2.4.2 - Reflected Cross-Site Scripting
Wyzi - Social Directory WordPress Theme
≤2.4.2Update to 2.4.3
- High7.5Unauthenticated Settings Import & Export
Ultimate GDPR & CCPA Compliance Toolkit for WordPress
<2.5Update to 2.5
- High8.8Cross-Site Request Forgery
Name Directory
≤1.17.4Update to 1.18
- High8.8Contact Form 7 Style <= 3.1.9 Cross-Site Request Forgery
Contact Form 7 Style
≤3.1.9No patch available
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.68Update to 1.5.68
- High8.8SQL Injection
wpDataTables (Premium)
≤3.4Update to 3.4.1
- Medium6.1Reflected Cross-Site Scripting
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.73Update to 3.74
- Critical9.8Authentication Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.1.9Update to 3.2.0
- High7.2Authenticated (Admin+) SQL injection
WP Editor
≤1.2.6.3Update to 1.2.7
- High7.5Unauthenticated Events Export
Modern Events Calendar Lite
≤5.16.4Update to 5.16.5