Database
Critical WordPress vulnerabilities (page 1279)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Arbitrary File Upload
Divi Builder
≤4.3.2Update to 4.5.3
- High7.5Authenticated PHP Object Injection
Newsletter – Send awesome emails from WordPress
<6.8.2Update to 6.8.2
- Medium5.4Missing Authorization to Unauthorized Backup Location Change
JetBackup – Backup, Restore & Migrate
≤1.4.0Update to 1.4.1
- Medium4.3Sensitive Information Disclosure
JetBackup – Backup, Restore & Migrate
≤1.4.0Update to 1.4.1
- High8.8Cross-Site Request Forgery
Social Rocket – Social Sharing Plugin
<1.2.10Update to 1.2.10
- High8.3Unauthenticated Stored Cross-Site Scripting
TC Custom JavaScript
<1.2.2Update to 1.2.2
- Medium6.5KEVPoCjQuery Manager for WordPress <= 1.10.4 & jQuery Migrate Helper <= 1.4.1- Running Vulnerable Dependency
Enable jQuery Migrate Helper
≤1.4.1No patch available
- Medium6.1Reflected Cross-Site Scripting
GreenMart – Organic & Food WooCommerce WordPress Theme
<2.4.3Update to 2.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<3.6.2Update to 3.6.2
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
JetBackup – Backup, Restore & Migrate
≤1.3.9Update to 1.4.0
- Medium4.9Authenticated SQL Injection
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.1Update to 4.5.1
- High8.8Cross-Site Request Forgery
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.1Update to 4.5.1
- High8.8Cross-Site Request Forgery
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<3.1.4Update to 3.1.4
- High7.51.04 - Unauthenticated SQL Injection
SRS Simple Hits Counter
1.0.3 – 1.0.4Update to 1.1.0
- High7.2Stored Cross-Site Scripting
Knight Lab Timeline
<3.7.0Update to 3.7.0
- Medium5.5Stored Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
<2.9.4Update to 2.9.4
- Medium6.4Authenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
<2.9.14Update to 2.9.14
- Medium6.5Unauthenticated Arbitrary File Deletion via Path Traversal
Adning Advertising
≤1.5.5Update to 1.5.6
- Critical9.8Arbitrary File Upload
Adning Advertising
≤1.5.5Update to 1.5.6
- High8.8Missing Authorization
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.50Update to 2.51
- High7.1Reflected Cross-Site Scripting
CareerUp - Job Board WordPress Theme
<2.3.1Update to 2.3.1
- Medium5.4Multiple Authenticated Stored Cross-Site Scripting
Testimonials Widget
≤3.5.1Update to 4.0.1
- Critical9.8SQL Injection
Payment Form for PayPal Pro
<1.1.65Update to 1.1.65
- High8.8Cross-Site Request Forgery
Clean Login
≤1.10.3Update to 1.10.4
- Critical9.8Real Estate WordPress Theme <= 1.7 - SQL Injection
Nexos - Real Estate WordPress Theme
≤1.7Update to 1.8
- High8.8Insecure Direct Object Reference
Advanced Forms for ACF
<1.6.9Update to 1.6.9
- Medium6.4Authenticated Stored Cross-Site Scripting
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
<5.1.2Update to 5.1.2
- Medium6.1Reflected Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.4Update to 2.9.5
- Critical9.8SQL Injection
Travel Booking WordPress Theme
<2.8.4Update to 2.8.4
- Medium6.5Arbitrary Quiz Deletion via Cross-Site Request Forgery
Wp-Pro-Quiz
≤0.37No patch available