Database
Critical WordPress vulnerabilities (page 1285)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Multiple Cross-Site Scripting Issues
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.45Update to 1.5.46
- Medium6.1Reflected Cross-Site Scripting
Hero Maps Premium
≤2.2.2Update to 2.2.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting and Setting Changes
Pricing Table by Supsystic – Responsive Pricing Plans & Comparison Tables
≤1.8.1Update to 1.8.2
- High8.1Lack of Origin Validation
CardGate Payments for WooCommerce
<3.1.16Update to 3.1.16
- Medium6.4Authenticated Stored Cross-Site Scripting
Modula Image Gallery – Photo Grid & Video Gallery
<2.2.5Update to 2.2.5
- High8.8Cross-Site Request Forgery
Easy Property Listings
<3.4Update to 3.4
- Medium6.4Stored Cross-Site Scripting
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
<1.5.9Update to 1.5.9
- Critical9.8Improper Access Control to Privilege Escalation
wpCentral
≤1.5.0Update to 1.5.1
- Critical9.82.6.7.6 - PHP Object Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
2.2.8 – 2.6.7.6Update to 3.0
- Critical9.91.6.1 - Authorization Bypass to Site Reset
Starter Templates & Sites Pack by ThemeGrill
1.3.4 – 1.6.1Update to 1.6.2
- Critical9.8Privilege Escalation
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<3.1.1Update to 3.1.1
- High8.1Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<4.6.0.3Update to 4.6.0.3
- Medium6.4Authenticated Stored Cross-Site Scripting and Authorization Bypass
CookieYes – Cookie Banner, Cookie Consent & Cookie Notice for GDPR/CCPA
≤1.8.2Update to 1.8.3
- Critical9.8Authentication Bypass
ManageWP Worker
≤4.9.2Update to 4.9.3
- High7.5SQL Injection
Participants Database
<1.9.5.6Update to 1.9.5.6
- Medium6.38.6 - Missing Authorization Checks
Indeed Membership Pro
7.3 – 8.6Update to 8.6.1
- Critical9.88.6 - Authentication Bypass
Indeed Membership Pro
7.3 – <8.6.1Update to 8.6.1
- High7.5Unauthenticated Information Disclosure
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.5Update to 5.5.1
- High8.0Authenticated (Subscriber+) Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.0.3Update to 0.9.0.3
- High8.8Cross-Site Request Forgery
Tutor LMS – eLearning and online course solution
<1.5.3Update to 1.5.3
- Medium6.4Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.23Update to 3.4.23
- High8.8Cross-Site Request Forgery
Htaccess by BestWebSoft – WordPress Website Access Control Plugin
≤1.8.1Update to 1.8.2
- Medium6.1Stored Cross Site Scripting
Strong Testimonials
≤2.40.0Update to 2.40.1
- High8.0Authenticated (Author+) CSV Injection
TablePress – Tables in WordPress made easy
≤1.14Update to 2.0
- Medium6.4Cross-Site Scripting
gistpress
<3.0.2Update to 3.0.2
- Medium6.13.11.2 - Cross-Site Scripting
Login by Auth0
3.11.0 – 3.11.2Update to 3.11.3
- Medium6.1Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.1Update to 4.6.0.3
- Medium6.1Reflected Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.8.4Update to 2.8.5
- High8.8Cross-Site Request Forgery to Remote Code Execution
Code Snippets
≤2.13.3Update to 2.14.0
- Medium6.1Cross-Site Scripting
SAML Single Sign On – SSO Login
≤4.8.83Update to 4.8.84