Database
Critical WordPress vulnerabilities (page 1297)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Unauthenticated Cross-Site Scripting
My Calendar – Accessible Event Manager
≤3.1.9Update to 3.1.10
- Critical9.8SQL Injection
RSVPMaker
≤6.1.9Update to 6.2
- Critical9.8Server-Side Request Forgery
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
≤1.6.6Update to 1.6.7
- High7.5Unauthenticated Arbitrary Media Deletion
Checkout Field Manager (Checkout Manager) for WooCommerce
≤4.2.6Update to 4.3
- Critical9.8Unauthenticated OS Command Injection
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<5.2Update to 5.2
- Medium6.4Stored Cross-Site Scripting
JobCareer | Job Board Responsive WordPress Theme
<2.5.1Update to 2.5.1
- High8.8Cross-Site Request Forgery
WDContactFormBuilder
<1.0.69Update to 1.0.69
- Medium6.1Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.1.1Update to 5.1.2
- Medium6.4Authenticated Stored Cross-Site Scripting
CarSpot – Dealership Wordpress Classified Theme
<2.1.7Update to 2.1.7
- Critical9.8Arbitrary File Upload
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
<2.0.1Update to 2.0.1
- High8.1PHP Object Injection
OptionTree
≤2.6.0Update to 2.7.0
- Medium6.1Reflected Cross-Site Scripting via URL parameter
MailPoet – Newsletters, Email Marketing, and Automation
<3.23.2Update to 3.23.2
- Medium6.1Cross-Site Scripting
Download Manager
<2.9.94Update to 2.9.94
- Critical9.6Cross-Site Request Forgery to Cross-Site Scripting via Comments
WordPress
≤5.1Update to 3.7.29 or 3.8.29 or 3.9.27 or 4.0.26 or 4.1.26 or 4.2.23 or 4.3.19 or 4.4.18 or 4.5.17 or 4.6.14 or 4.7.13 or 4.8.9 or 4.9.10 or 5.0.4 or 5.1.1
- Critical9.8Unauthenticated Arbitrary Options Update
Visual CSS Style Editor
<7.2.1Update to 7.2.1
- High8.1File Uploads <= 3.0.22 - Unauthenticated Arbitrary File Upload
Ninja Forms - File Uploads
<3.0.23Update to 3.0.23
- High7.2Missing Authorization to Stored Cross-Site Scripting
YUZO
<5.12.94Update to 5.12.94
- Medium6.1Referer Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.3Update to 12.6.4
- High7.3Missing Authorization and No Direct File Access Restrictions
ARI Adminer – WordPress Database Manager
≤1.1.14Update to 1.1.15
- High8.8Remote Code Execution
Groundhogg — CRM, Newsletters, and Marketing Automation
<1.3.5Update to 1.3.5
- High8.1Cross-Site Request Forgery to Local File Inclusion
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.13.4Update to 1.13.5
- High8.8Cross-Site Request Forgery
Contact Form by WD – responsive drag & drop contact form builder tool
<1.13.5Update to 1.13.5
- High8.8Cross-Site Request Forgery
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.40Update to 2.0.40
- High7.5Denial of Service
article2pdf
≤0.27No patch available
- Critical9.8Backdoor
Pipdig Power Pack (P3)
≤4.7.3Update to 4.8.0
- Medium4.3Insufficient Restrictions on Option Changes
Easy Updates Manager
≤8.0.4Update to 8.0.5
- Critical9.10.27 - Information Disclosure
article2pdf
≤0.27No patch available
- Critical9.8Unauthenticated Settings Update to Remote Code Execution
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.1.2Update to 5.1.3
- High7.2VulnCrest analysisKEVPoCUnauthenticated Arbitrary Settings Update
Social Sharing Plugin – Social Warfare
<3.5.3Update to 3.5.3
- Medium6.1Reflected Cross-Site Scripting
Font Organizer
≤2.1.1No patch available