Database
Critical WordPress vulnerabilities (page 1283)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Stored Cross-Site Scripting
OneTone Companion
≤1.1.1No patch available
- Critical9.8Unauthenticated Settings Update
OneTone Companion
≤1.1.1No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Contact Form 7 Datepicker
≤2.6.0No patch available
- Medium6.5Authenticated Map Creation/Deletion to Stored Cross-Site Scripting & Remote Code Execution
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
<2.53.9Update to 2.53.9
- High7.2Stored Cross-Site Scripting
Login by Auth0
≤3.11.3Update to 4.0.0
- High8.8Cross-Site Request Forgery
Login by Auth0
≤3.11.3Update to 4.0.0
- Critical9.8Unauthenticated SQL Injection
LearnDash LMS
≤3.1.5Update to 3.1.6
- Medium4.3Insecure Direct Object Reference
Login by Auth0
≤3.11.3Update to 4.0.0
- Critical9.8CSV Injection
Login by Auth0
≤3.11.3Update to 4.0.0
- Medium6.5Authorization Bypass
Elementor Website Builder – more than just a page builder
≤2.9.5Update to 2.9.6
- Critical9.8Arbitrary File Write
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<3.37.15Update to 3.37.15
- Medium5.5Stored Cross-Site Scripting
Login by Auth0
≤3.11.3Update to 4.0.0
- Medium5.5Missing Authorization
Spectra Legacy – Gutenberg Blocks
≤1.14.7Update to 1.14.8
- Critical9.8SQL Injection
Custom Searchable Data Entry System
≤1.7.1No patch available
- Medium6.1Bootstrap Admin Theme with AngularJS <= 1.3 - Reflected Cross-Site Scripting
Xenon - Bootstrap Admin Theme with AngularJS
≤1.3No patch available
- High8.1Authenticated Arbitrary Post Creation, Modification, and Deletion
IMPress for IDX Broker
<2.6.2Update to 2.6.2
- Medium5.4Authenticated Stored Cross-Site Scripting
IMPress for IDX Broker
<2.6.2Update to 2.6.2
- Critical9.8Privilege Escalation via Unprotected REST API Endpoint
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.41Update to 1.0.41
- High7.4Redirect Creation via Unprotected REST API Endpoint
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.40Update to 1.0.41
- High8.8Cross-Site Request Forgery
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.9.91Update to 1.9.92
- Medium6.3Missing Authorization on AJAX Actions
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.9.91Update to 1.9.92
- Medium4.9Sensitive Information Disclosure
WPvivid — Backup, Migration & Staging
<0.9.36Update to 0.9.36
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Read More Without Refresh
≤3.1Update to 3.2
- Critical9.8File Uploads Extension <= 3.3.0 - Arbitrary File Upload
Ninja Forms - File Uploads
≤3.3.0Update to 3.3.1
- Medium6.4Unprotected AJAX Action to Stored/Reflected Cross-Site Scripting
Accordions
<2.2.9Update to 2.2.9
- High7.1Privilege Escalation
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.6Update to 3.2.6.8
- Medium6.4Stored Cross-Site Scripting
Fruitful
<3.8.2Update to 3.8.2
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
WPvivid — Backup, Migration & Staging
≤0.9.35Update to 0.9.36
- Critical9.8Directory Traversal to Remote Code Execution
Iptanus File Upload
≤4.12.2Update to 4.13.0
- High8.3Unauthenticated Stored Cross-Site Scripting
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.63Update to 3.64.1