Database
Critical WordPress vulnerabilities (page 1276)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Function Injection
Sparkling
≤2.4.8Update to 2.4.9
- High8.8SQL Injection
Slider by 10Web – Responsive Image Slider
≤1.2.35Update to 1.2.36
- High7.5Improper Access Controls
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤2.0.28Update to 2.0.29
- Medium4.3Cross-Site Request Forgery Bypass
Ocean Extra
<1.6.6Update to 1.6.6
- Medium4.3Cross-Site Request Forgery Bypass
Customizr
≤4.3.0Update to 4.3.1
- Medium4.3Cross-Site Request Forgery Bypass
Hueman
≤3.6.3Update to 3.6.4
- Medium4.3Cross-Site Request Forgery Bypass
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
<1.6.4Update to 1.6.4
- Medium4.3Cross-Site Request Forgery Bypass
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
<1.5.16Update to 1.5.16
- Critical9.8Arbitrary File Upload
Simple:Press Forum
<6.6.1Update to 6.6.1
- Critical9.8SQL Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.2Update to 2.3.3
- High7.5Insecure Cryptography to Sensitive Information Disclosure
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- High8.8Cross-Site Request Forgery to Plugin Installation
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- High7.5Password Hash Extraction
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- Medium6.1Cross-Site Scripting
UpdraftPlus Premium
<1.9.64Update to 1.9.64
- Medium5.3Validation Bypass via Email Field
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- High7.5Sensitive Information Exposure
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- Critical9.8SQL Injection
Advanced Contact form 7 DB
≤1.6.2Update to 1.7.0
- Medium6.1Reflected Cross-Site Scripting
15Zine | Magazine Newspaper Blog News WordPress Theme
<3.3.0Update to 3.3.0
- Medium6.5Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27.1Update to 3.4.28
- High7.5Stored Cross-Site Scripting
Team Showcase
<1.22.16Update to 1.22.16
- High7.5Object Injection
Team Showcase
<1.22.16Update to 1.22.16
- High7.5Object Injection
Team Showcase
<1.22.16Update to 1.22.16
- High7.5Stored Cross-Site Scripting
Team Showcase
<1.22.16Update to 1.22.16
- Medium4.3Cross-Site Request Forgery Bypass
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
<3.0.9Update to 3.0.9
- Medium4.3Cross-Site Request Forgery Bypass
Menu Swapper
≤1.1.0.2Update to 1.1.1
- High8.8Cross-Site Request Forgery
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Medium4.3Cross-Site Request Forgery Bypass
Lightweight Sidebar Manager
≤1.1.4Update to 1.1.5
- Medium4.3Cross-Site Request Forgery Bypass
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
<1.8.3Update to 1.8.3
- Medium4.3Cross-Site Request Forgery Bypass
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
<2.4.1Update to 2.4.1
- Medium4.3Cross-Site Request Forgery Bypass
Product Catalog Simple
<1.5.13Update to 1.5.13