Database
Critical WordPress vulnerabilities (page 1294)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Scripting via contentarea Parameter
Newsletters
<4.6.19Update to 4.6.19
- Critical9.8Unauthenticated Blind SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.6.1Update to 12.6.7
- Critical9.8Code Injection
Easy Forms for Mailchimp
<6.5.3Update to 6.5.3
- High8.8SQL Injection
Server Status by Hostname/IP
≤4.6Update to 5.0
- Medium6.1Cross-Site Scripting
Easy restaurant menu manager
≤1.1.2Update to 1.2
- High8.8Cross-Site Request Forgery
Converter for Media – Optimize images | Convert WebP & AVIF
≤1.0.2Update to 1.0.3
- High8.8Cross-Site Request Forgery
ACF: Better Search
<3.3.1Update to 3.3.1
- High8.8Cross-Site Request Forgery
WP Better Permalinks
<3.0.5Update to 3.0.5
- Medium6.1Reflected Cross-Site Scripting
360 Product Rotation
<1.4.8Update to 1.4.8
- Medium5.4Stored Cross-Site Scripting
WP Ultimate Recipe
<3.12.7Update to 3.12.7
- Medium5.4Authenticated Stored Cross-Site Scripting
WebP Express
<0.14.11Update to 0.14.11
- Critical9.8SQL Injection
Author Chat
≤1.9.0Update to 2.0.0
- Medium6.1Cross-Site Scripting
Limb Gallery | Create Beautiful Image & Video Galleries
<1.4.0Update to 1.4.0
- Medium6.1Reflected Cross-Site Scripting
Custom 404 Pro
<3.2.9Update to 3.2.9
- High8.8Cross-Site Request Forgery
HTML5 Maps
≤1.6.5.6Update to 1.6.5.7
- Medium6.1Cross-Site Request Forgery and Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.51Update to 2.0.52
- Medium5.4Cross-Site Request Forgery and Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.51Update to 2.0.52
- Medium6.1Reflected Cross-Site Scripting
Custom 404 Pro
<3.2.8Update to 3.2.8
- High8.8Cross-site Request Forgery
Custom CSS Pro
≤1.0.3Update to 1.0.4
- Medium5.7Cross-Site Request Forgery
Admin renamer extended
≤3.2.1No patch available
- Medium5.4Cross-Site Scripting
CP Contact Form with PayPal
<1.3.02Update to 1.3.02
- Medium6.1Cross-Site Scripting
CP Contact Form with PayPal
≤1.3.01Update to 1.3.02
- High8.8Cross-Site Request Forgery
Deny All Firewall
≤1.1.6Update to 1.1.7
- Medium6.3Cross-Site Request Forgery leading to attachment deletion & Path Traversal
Import and export users and customers
≤1.14.1.3Update to 1.14.2.2
- Medium6.5Authenticated Settings Reset via reset-cmb Parameter
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.27.1Update to 1.0.27.1
- Medium6.1Cross-Site Scripting
Import and export users and customers
≤1.14.1.2Update to 1.14.1.3
- High7.5Directory Traversal
Import and export users and customers
≤1.14.2.1Update to 1.14.2.2
- High8.8Cross-Site Request Forgery
GoHero Store Customizer for WooCommerce
≤2.4Update to 2.5
- High7.2Unauthenticated Stored Cross-Site Scripting via track_link
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<2.1.10Update to 2.1.10
- Critical9.8Local File Inclusion
Sina Extension for Elementor
<2.2.1Update to 2.2.1