Database
Critical WordPress vulnerabilities (page 1272)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated SQL Injection
Modern Events Calendar Lite
≤5.16.5Update to 5.16.6
- Medium6.4Authenticated Stored Cross-Site Scripting
Modern Events Calendar Lite
≤5.16.4Update to 5.16.5
- High7.2Authenticated Arbitrary File Upload leading to Remote Code Execution
Modern Events Calendar Lite
≤5.16.4Update to 5.16.5
- Critical9.8Missing Authorization
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.6Unauthenticated Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<4.09.05Update to 4.09.05
- Critical9.1Unauthenticated Arbitrary Post/Page Deletion
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Options Changes via wp_route
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Wordpress Options Changes via AJAX
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- High7.5Unauthenticated Information Disclosure
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Arbitrary Account Changes
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Medium6.5Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Arbitrary Account Creation
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Arbitrary File Upload
Super Forms – Drag & Drop Form Builder
≤4.9.700Update to 4.9.800
- Critical9.8Arbitrary File Upload
YITH WooCommerce Gift Cards Premium
<3.3.1Update to 3.3.1
- High8.8CSV Injection
Database Addon for Contact Form 7 – CFDB7
<1.2.5.6Update to 1.2.5.6
- Medium6.5Information Disclosure
Doneren met Mollie
≤2.8.4Update to 2.8.5
- Medium6.1Reflected Cross-Site Scripting
Advanced Custom Fields Pro
<5.9.1Update to 5.9.1
- Critical9.8Arbitrary File Upload
123ContactForm for WordPress
≤1.5.6No patch available
- Critical9.8Validation Bypass via Plugin Verification
123ContactForm for WordPress
≤1.5.6No patch available
- High7.2Easy Redirect Manager < 2.51 - SQL Injection
301 Redirects – Redirect Manager
<2.51Update to 2.51
- Medium6.1Reflected Cross-Site Scripting
WP Shieldon – WordPress Firewall
≤1.6.3Update to 1.6.4
- Medium5.42.7.26 - Authenticated Stored Cross-Site Scripting
Pods – Custom Content Types and Fields
2.4.4.1 – <2.7.27Update to 2.7.27
- Critical9.8Incorrect Permission Assignment or Protection
WP Editor
<1.2.6Update to 1.2.6
- Medium6.4Authenticated Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.4.37.727Update to 7.4.38.727
- Medium5.4Authenticated Stored Cross-Site Scripting via Menu Label field
Pods – Custom Content Types and Fields
2.4.4.2 – 2.7.26Update to 2.7.27
- Medium5.4Authenticated Stored Cross-Site Scripting
Easy Contact Form Pro
<1.1.1.9Update to 1.1.1.9
- High8.8Cross-Site Request Forgery
FormsDB – Save Elementor Forms to Google Sheets & Post Type
≤1.5Update to 1.6
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
<2.10.3Update to 2.10.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Quick FrontEnd Editor – WordPress Plugin
≤5.5No patch available
- Medium4.3Authenticated Settings Change
WP Quick FrontEnd Editor – WordPress Plugin
≤5.5No patch available