Database
Critical WordPress vulnerabilities (page 1295)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
Meta for WooCommerce
≤1.9.12Update to 1.9.15
- High8.8Cross-Site Request Forgery allowing Option Update
Meta for WooCommerce
≤1.9.12Update to 1.9.15
- Medium4.3Unauthorized Profile Modification
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High8.8Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High8.8Cross-Site Request Forgery
WP-Members Membership Plugin
≤3.2.7Update to 3.2.8.1
- Medium6.1Stored Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.9.16Update to 2.9.16
- High8.8Cross-Site Request Forgery
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤10.4.4Update to 10.4.5
- High8.8Arbitrary File Upload
Insert or Embed Articulate Content into WordPress
<4.2999Update to 4.2999
- Medium6.1Cross-Site Scripting
Online Lesson Booking
≤0.8.6Update to 0.8.7
- High8.8Cross-site Request Forgery
Attendance Manager
≤0.5.6Update to 0.5.7
- Medium6.1Stored Cross-Site Scripting
Attendance Manager
≤0.5.6Update to 0.5.7
- High8.8Cross-Site Request Forgery
Online Lesson Booking
≤0.8.6Update to 0.8.7
- Critical9.8Local File Inclusion
Revamp CRM for WooCommerce
<1.0.4Update to 1.0.4
- High8.8Cross-Site Request Forgery
Breadcrumbs by menu
≤1.0.1Update to 1.0.3
- Medium6.1Cross-Site Scripting
Breadcrumbs by menu
<1.0.3Update to 1.0.3
- High7.5Unauthorized Account Creation
ConvertPlus
≤3.4.4Update to 3.4.5
- High8.8Arbitrary File Upload
Crelly Slider
≤1.3.4Update to 1.3.5
- Medium6.4Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.5Update to 12.6.6.1
- High7.2Stored Cross-Site Scripting
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
<1.0.9Update to 1.0.9
- Critical9.8Unprotected Functions
3CX Free Live Chat, Calls & Messaging
<8.0.33Update to 8.0.33
- Medium6.1Cross-Site Scripting
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
≤1.0.8Update to 1.0.9
- High8.8Cross-Site Request Forgery
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
<1.0.9Update to 1.0.9
- High8.8Cross-Site Request Forgery
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
≤1.0.8Update to 1.0.9
- Critical9.8Unauthenticated Administrator Creation
ConvertPlus
<3.4.3Update to 3.4.3
- High8.8Privilege Escalation
Slick Popup: Contact Form 7 Popup Plugin
<1.7.2Update to 1.7.2
- Medium6.1Cross-Site Scripting
SAML Single Sign On – SSO Login
<4.8.73Update to 4.8.73
- High8.8Cross-Site Request Forgery
Affiliates Manager
<2.6.6Update to 2.6.6
- High7.2Stored Cross-Site Scripting
Hostel
≤1.1.3Update to 1.1.4
- High8.8Cross-site Request Forgery
Related YouTube Videos
<1.9.9Update to 1.9.9
- High7.8Unauthenticated CSV Injection
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤6.0.7Update to 6.0.8.1