Database
Critical WordPress vulnerabilities (page 1277)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
<2.3.10Update to 2.3.10
- Medium4.3Cross-Site Request Forgery Bypass
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Medium4.3Cross-Site Request Forgery Bypass
10WebAnalytics
<1.2.9Update to 1.2.9
- Medium4.3Cross-Site Request Forgery Bypass
WebberZone Top 10 — Popular Posts
<2.9.5Update to 2.9.5
- Medium4.3Cross-Site Request Forgery Bypass
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.4.3Update to 2.4.3
- Medium4.3Cross-Site Request Forgery Bypass
WP Hotel Booking
<1.10.2Update to 1.10.2
- Medium4.3Cross-Site Request Forgery Bypass
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
<3.4.3Update to 3.4.3
- Medium4.3Cross-Site Request Forgery Bypass
Custom Field Template
<2.5.2Update to 2.5.2
- Medium4.3Cross-Site Request Forgery Bypass
Menu Swapper
≤1.1.0.2Update to 1.1.1
- Medium4.3Cross-Site Request Forgery Bypass
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
<1.8.3Update to 1.8.3
- Medium4.3Cross-Site Request Forgery Bypass
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
<2.4.1Update to 2.4.1
- Medium4.3Cross-Site Request Forgery Bypass
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
<3.5.8Update to 3.5.8
- Medium4.3Cross-Site Request Forgery Bypass
Product Catalog Simple
<1.5.13Update to 1.5.13
- Medium4.3Cross-Site Request Forgery Bypass
Radio Buttons for Taxonomies
<2.0.6Update to 2.0.6
- High8.8Cross-Site Request Forgery
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Critical9.8SQL Injection
DiveBook
≤1.1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
DiveBook
≤1.1.4No patch available
- Medium5.3Sensitive Information Disclosure via Directory Listing
Noo JobMonster
≤4.6.6Update to 4.6.6.1
- Medium5.3Unauthenticated Email Forgery
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.6Update to 4.5.6
- Critical9.8SQL Injection
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤7.11.17Update to 7.11.18
- Medium4.3Cross-Site Request Forgery Bypass
EWWW Image Optimizer
≤5.8.1Update to 5.9
- Medium4.3Cross-Site Request Forgery
ActiveCampaign – The autonomous marketing platform
<8.0.2Update to 8.0.2
- High7.2SQL injection
Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance
<3.0.2Update to 3.0.2
- Medium5.5Constant Contact Forms <= 1.8.7 Editor+ Stored Cross-Site Scripting
Constant Contact Forms
<1.8.8Update to 1.8.8
- Medium5.0Missing Authorization
NextScripts: Social Networks Auto-Poster
≤4.3.17Update to 4.3.18
- Critical9.8Arbitrary File Upload
Augmented reality plugin
≤1.2.0No patch available
- Critical9.8KEVPoCArbitrary File Upload/Remote Code Execution
File Manager
≤6.8Update to 6.9
- High8.8Authenticated SQL Injection
Recall Products
≤0.8No patch available
- Medium6.1Cross-Site Scripting
Chamber Dashboard Business Directory
<3.3.1Update to 3.3.1
- Medium5.4Cross-Site Scripting
Recall Products
≤0.8No patch available