Database
Critical WordPress vulnerabilities (page 1284)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Authenticated Settings Modification, Configuration Disclosure, and User Data Export
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.63Update to 3.64.1
- High8.3Blind Server-Side Request Forgery via tree.php
Canto
<2.0.1Update to 2.0.1
- High8.3Unauthenticated Stored Cross-Site Scripting
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.63Update to 3.64.1
- Critical9.8Remote Code Execution
Search Meter
<2.13.3Update to 2.13.3
- Medium4.3Missing Authorization to CSV Import
Product Import Export for WooCommerce – CSV Product Importer & Exporter
<1.7.5Update to 1.7.5
- Critical9.8Authentication Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
<2.1.6Update to 2.1.6
- High8.8Cross-Site Request Forgery Bypass
WPML Multilingual CMS
<4.3.7Update to 4.3.7
- Critical9.8Missing Authorization
ThemeREX Addons
≤1.70.3Update to 1.6.49.10 or 1.6.49.6 or 1.6.49.6.3 or 1.6.49.7 or 1.6.50.2 or 1.6.51.4 or 1.6.52.3 or 1.6.53.4 or 1.6.54.1 or 1.6.55.8 or 1.6.56.1 or 1.6.57.4 or 1.6.58.3 or 1.6.59.1.2 or 1.6.59.4 or 1.6.60.1 or 1.6.61.1.1 or 1.6.61.2.1 or 1.6.62.4 or 1.6.65.1 or 1.6.66.1 or 1.6.67.1 or 1.70.3.1
- High7.3Missing Authorization
WP Activity Log
<4.0.2Update to 4.0.2
- Critical9.1Unauthenticated Database Wiping
Custom Searchable Data Entry System
≤1.7.1No patch available
- High8.0Cross-Site Request Forgery to Settings Modification
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- Critical9.9Authenticated Privilege Escalation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- Critical9.8Remote Code Execution
WordPress WP-Advanced-Search
<3.3.4Update to 3.3.4
- Medium4.3Authenticated Settings and User Data Export
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.4Update to 4.6.0.4
- Critical9.9Authenticated Settings Import to Privilege Escalation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.3Update to 4.6.0.4
- Medium4.3Authenticated Email Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.3Update to 4.6.0.4
- Medium4.8Stored Cross-Site Scripting
Appointment Booking Calendar
<1.3.35Update to 1.3.35
- High7.8CSV Injection
Appointment Booking Calendar
<1.3.35Update to 1.3.35
- Critical9.1Unprotected AJAX Actions
Responsive Starter Templates – Elementor Templates & Starter Sites
<2.2.6Update to 2.2.7
- Medium5.3Unauthenticated Coupon Creation
WooCommerce Smart Coupons
<4.6.5Update to 4.6.5
- High7.5VulnCrest analysisKEVPoCDirectory Traversal
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<1.3.28Update to 1.3.28
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Async JavaScript
<2.20.02.27Update to 2.20.02.27
- Medium5.4Missing Authorization to Stored Cross-Site Scripting and Settings Update
Modern Events Calendar Lite
<5.1.7Update to 5.1.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change
10Web Map Builder for Google Maps
<1.0.64Update to 1.0.64
- Medium6.1Unauthenticated Stored Cross-Site Scripting
WP Job Board
≤5.5.3Update to 5.6.0
- High7.2Unauthenticated Arbitrary Plugin Settings Update
Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager
<2.3.2Update to 2.3.2
- Medium6.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.2Update to 2.9.3
- Medium6.4Authenticated Stored Cross-Site Scripting
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
<1.7.7Update to 1.7.7
- High7.3Missing Authorization on AJAX Actions
Pricing Table by Supsystic – Responsive Pricing Plans & Comparison Tables
≤1.8.1Update to 1.8.2
- Medium6.1Reflected Cross-Site Scripting
Hero Maps Premium
≤2.2.2Update to 2.2.3