Database
Critical WordPress vulnerabilities (page 1278)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated SQL Injection
Recall Products
≤0.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Subscribe Sidebar plugin by Blubrry
≤1.3.1No patch available
- Critical9.8Arbitrary File Upload
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.0.1Update to 7.0.2
- High7.2SQL Injection
WordPress Poll
≤36No patch available
- High7.2Authenticated Arbitrary File Upload
Autoptimize
≤2.7.6Update to 2.7.7
- Medium6.1Cross-Site Scripting via id Parameter
WP Floating Menu – One page navigator, sticky menu for WordPress
<1.4.1Update to 1.4.1
- Critical9.8Unauthenticated SQL Injection via 'event_count'
RSVPMaker
<7.8.2Update to 7.8.2
- High8.6Unauthenticated Arbitrary Post Deletion
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High8.8Cross-Site Request Forgery
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High7.1Missing Authorization to Settings Update
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- Medium4.3Authenticated Information Disclosure
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- Medium6.3Missing Authorization
Discount Rules for WooCommerce
≤2.0.2Update to 2.1.0
- High7.5Payment System Bypass
NAB Transact
<2.1.2Update to 2.1.2
- Medium6.1Multiple Stored Cross-Site Scripting
WP Customer Reviews
≤3.4.2Update to 3.4.3
- Critical9.8Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<4.2.153Update to 4.2.153
- High8.84.2.12 - Unprotected AJAX Actions
Backup, Restore and Migrate your sites with XCloner
4.2.1 – 4.2.12Update to 4.2.153
- High7.5Authenticated Authorization Bypass and Privilege Escalation
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- High8.6CSV injection via form entry
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.4.7Update to 1.4.8
- High7.5Unauthenticated Resource Access to Site Backups
File Manager
≤6.4Update to 6.5
- Medium6.1Cross-Site Scripting
Sell Media
<2.4.2Update to 2.4.2
- Medium6.1Reflected Cross-Site Scripting
Ultimate Appointment Booking & Scheduling
<1.1.10Update to 1.1.10
- Medium6.1Reflected Cross-Site Scripting
RSS Feed Widget
<2.8.1Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
Admin Menu
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Nova Lite
<1.3.9Update to 1.3.9
- High8.3Missing Authorization
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤3.8.1Update to 3.8.2
- High7.4Missing Capabilities Check
Facebook Chat Plugin – Live Chat Plugin for WordPress
<1.6Update to 1.6
- High8.2Unauthenticated Arbitrary File Deletion
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<7.0.1Update to 7.0.1
- High7.5Missing Authorization
Product Input Fields for WooCommerce
≤1.2.6Update to 1.2.7
- High8.8Arbitrary File Upload
Divi Builder
≤4.3.2Update to 4.5.3
- Critical9.8Arbitrary File Upload
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<7.0.1Update to 7.0.1