Database
Critical WordPress vulnerabilities (page 1298)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Sensitive Information Disclosure
WP Human Resource Management
<2.2.6Update to 2.2.6
- Critical9.8Missing Authorization to Arbitrary Options Update
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
<1.3.9.1Update to 1.3.9.1
- Critical9.3SQL Injection
Better Search – Relevant search results for WordPress
<2.2.3Update to 2.2.3
- High8.8Cross-Site Request Forgery
Import and export users and customers
<1.14.0.3Update to 1.14.0.3
- Medium6.1Cross-Site Scripting
Import and export users and customers
<1.14.0.3Update to 1.14.0.3
- Critical9.8Missing Authorization
Speed Optimizer – The All-In-One Performance-Boosting Plugin
<5.0.13Update to 5.0.13
- Critical9.8Local File Inclusion
GraceMedia Media Player
≤1.0No patch available
- Critical9.8Missing Authorization
Caldera Forms Pro
<1.8.2Update to 1.7.7 or 1.8.2
- High7.2Stored Cross-Site Scripting
Abandoned Cart Lite for WooCommerce
<5.2.0Update to 5.2.0
- Critical9.8Remote Code Execution via unrestricted file upload
wp-live-chat-support-pro
≤8.0.06Update to 8.0.07
- Medium6.1Stored Cross-Site Scripting
WooCommerce Subscription
<2.6.3Update to 2.6.3
- Medium6.1Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤6.2.1Update to 6.2.2
- Medium6.1Cross-Site Scripting via tribe_paged Parameter
The Events Calendar
<4.8.2Update to 4.8.2
- High8.8Cross-Site Request Forgery
Smart Forms – when you need more than just a contact form
<2.6.26Update to 2.6.26
- High8.8Cross-Site Request Forgery
FormCraft – Form Builder
≤1.2.1Update to 1.2.2
- High8.8Cross-Site Request Forgery
FormCraft – Form Builder
<1.2.2Update to 1.2.2
- Critical9.8Arbitrary File Upload
Indeed Membership Pro
≤7.5Update to 7.6
- High8.8Multiple Cross-Site Request Forgery vulnerabilities
LoginWP (Formerly Peter's Login Redirect)
≤2.9.1Update to 2.9.2
- High7.5Authorization Bypass
WP Human Resource Management
<2.2.6Update to 2.2.6
- Medium6.1Stored Cross-Site Scripting
WooCommerce
<3.5.5Update to 3.5.5
- Medium6.5Path Traversal and Local File Inclusion
WordPress
≤5.0.2Update to 5.0.3
- High8.8Remote Code Execution
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.5Authenticated Denial of Service
PS PHPCaptcha WP
≤1.1.0Update to 1.2.0
- Medium6.4Stored Cross-Site Scripting
Launcher: Coming Soon & Maintenance Mode
<1.0.11Update to 1.0.11
- Critical9.8Missing Authorization to Arbitrary File Upload/Delete
WP Cost Estimation & Payment Forms Builder
<9.644Update to 9.644
- Medium6.5Upload Directory Traversal
WP Cost Estimation & Payment Forms Builder
<9.660Update to 9.660
- Medium6.1Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.6Update to 1.6
- Medium6.5SQL Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.6Update to 1.6
- Medium6.1Reflected Cross-Site Scripting
NextScripts: Social Networks Auto-Poster
<4.2.8Update to 4.2.8
- Medium6.1Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.3.1Update to 2.3.1