Database
Critical WordPress vulnerabilities (page 1281)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
<1.1.2Update to 1.1.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
≤3.4.18Update to 3.4.19
- Critical9.8Unauthenticated Privilege Escalation
bbPress
≤2.6.4Update to 2.6.5
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table
bbPress
≤2.6.4Update to 2.6.5
- High7.4Missing Authorization to Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
<1.1.2Update to 1.1.2
- High8.8Remote Code Execution via Improper Capability Checks in AJAX Calls
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.54.5Update to 2.54.6
- Medium5.4Stored Cross-Site Scripting
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.9.2Update to 3.9.3
- Critical9.8Unauthenticated SQL Injection
MailerLite – Signup forms (official)
<1.4.4Update to 1.4.4
- Medium4.3Sensitive Information Disclosure
Site Kit by Google – Analytics, Search Console, AdSense, Speed
≤1.7.1Update to 1.8.0
- Medium6.5Cross-Site Request Forgery
multi Scheduler
≤1.0.0No patch available
- Medium4.7Authenticated SQL Injection
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.3.3Update to 2.3.3
- Medium5.5Multiple Cross-Site Scripting
Visual Composer Website Builder
≤26.0Update to 27.0
- High7.2SQL Injection
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
<5.3.2Update to 5.3.2
- Medium6.4Authenticated Cross-Site Scripting
Team Members
<5.0.4Update to 5.0.4
- Medium6.5Arbitrary File Deletion
Simple File List
≤4.2.7Update to 4.2.8
- Critical9.8SQL Injection via bwg_search_x Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.55Update to 1.5.55
- High7.4Missing Authorization
Login & Register Customizer – Forms, Popup, Profile & WooCommerce
<1.5Update to 1.5
- Medium5.4Authenticated Stored Cross-Site Scripting
Easy Testimonials
≤3.5.2Update to 3.6
- Medium6.5Failure to Restrict URL Protocol
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
≤2.3.4Update to 2.3.5
- Medium5.5Cross-Site Scripting
ImageBoss – Image Optimization & CDN
<3.0.6Update to 3.0.6
- High8.8Cross-Site Request Forgery to Reflected Cross-Site Scripting
Page Builder by SiteOrigin
<2.10.16Update to 2.10.16
- Critical9.8Unauthenticated SQL Injection
Chop Slider 3
≤3.4No patch available
- Medium6.1Authenticated Stored Cross Site Scripting
iframe
≤4.4Update to 4.5
- Critical9.9Authenticated (Subscriber+) Arbitrary File Upload
Elementor Website Builder Pro
<2.9.4Update to 2.9.4
- High7.2Registration Bypass
Ultimate Addons for Elementor
<1.24.2Update to 1.24.2
- High8.8Cross-Site Request Forgery to Reflected Cross-Site Scripting
Page Builder by SiteOrigin
≤2.10.15Update to 2.10.16
- High8.8Cross-Site Request Forgery
wpForo Forum
≤1.6.5Update to 1.7.0
- Medium6.1Cross-Site Scripting via langid parameter
wpForo Forum
≤1.6.5Update to 1.7.0
- Medium4.8Cross-Site Scripting via s parameter
wpForo Forum
≤1.6.5Update to 1.7.0
- Medium6.1Cross-Site Scripting via wpf-dw-td-value class
wpForo Forum
≤1.6.5Update to 1.7.0