Database
Critical WordPress vulnerabilities (page 1291)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated Stored Cross-Site Scripting
Additional Variation Images Gallery for WooCommerce
<1.1.29Update to 1.2.29
- Medium6.1Reflected Cross-Site Scripting
Variation Swatches for WooCommerce
<1.0.62Update to 1.0.62
- Medium6.1Reflected Cross-Site Scripting
Sender by BestWebSoft
≤1.2.0Update to 1.2.1
- High7.5Missing Authorization Checks
WP All Import Pro
<4.1.1Update to 4.1.1
- Medium6.1Cross-Site Scripting
Easy Property Listings
≤3.3.3Update to 3.4
- Medium6.1Cross-Site Scripting
OptionTree
≤2.5.5Update to 2.6
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.9Update to 4.0.9
- High8.8Cross-Site Request Forgery
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤5.6Update to 5.6.1
- Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<4.0.2Update to 4.0.2
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.3Update to 2.0.4
- High8.8Cross-Site Request Forgery
Contact Form Email
≤1.2.65Update to 1.2.66
- Medium4.3Directory Traversal
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.88Update to 2.0.4
- Critical9.8Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
GiveWP – Donation Plugin and Fundraising Platform
≤2.5.0Update to 2.5.1
- Medium6.1Cross-Site Scripting
Contact Form Email
≤1.2.65Update to 1.2.66
- High8.8Cross-Site Request Forgery
Social Feed Gallery
<2.4.8Update to 2.4.8
- High8.8Unauthenticated HTML Injection & Cross-Site Request Forgery
cformsII
<15.0.2Update to 15.0.2
- High7.2Missing Authorization
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- Medium5.4Authenticated Stored Cross-Site Scripting
PPOM – Product Addons & Custom Fields for WooCommerce
<18.4Update to 18.4
- Medium6.1Missing Authentication on Option Changes
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Social LikeBox & Feed
≤2.8.4Update to 2.8.5
- Critical9.8Options Change
Restaurant Reservations
≤1.3Update to 1.5
- High7.5Arbitrary Post Deletion
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
≤2.2.5Update to 2.2.6
- High8.8Cross-Site Request Forgery to Remote Code Execution
WP SVG Icons
<3.2.3Update to 3.2.3
- Critical9.8PHP Object Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<4.02.01Update to 4.02.01
- High8.8< 2.3 - Cross-Site Request Forgery
Pricing Table Plugin
<2.3Update to 2.3
- Medium6.1Unauthenticated Settings Update
Login or Logout Menu Item
<1.2.0Update to 1.2.0
- Critical9.8SQL Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.44Update to 3.45
- Medium6.1Open Redirect
Learning Courses
≤4.7Update to 4.8
- Critical9.6Unauthenticated Arbitrary Options Update
Hotel Booking
<2.5Update to 2.5