Database
Critical WordPress vulnerabilities (page 1306)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Local File Inclusion
Site Editor
≤1.1.1No patch available
- Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.32Update to 1.2.33
- Medium5.3Spam Injection
MailPoet Newsletters (Previous)
≤2.8.1Update to 2.8.2
- Critical9.8Object Injection
Newsletters
<4.6.8.6Update to 4.6.8.6
- High8.8Cross-Site Request Forgery
bbPress Move Topics
<1.1.5Update to 1.1.5
- High8.8PHP Object Injection
bbPress Move Topics
≤1.1.4Update to 1.1.6
- Medium6.1Multiple Cross-Site Scripting
Activity Log – Monitor User and Agent Changes
≤2.4.0Update to 2.4.1
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.7Update to 3.4.7
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.6Update to 3.4.6
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.7Update to 3.4.7
- Critical9.8Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
<1.2.0Update to 1.2.0
- Critical9.8Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
<1.2.0Update to 1.2.0
- High7.5Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
≤6.9.0Update to 6.9.1
- Critical9.8Authentication Bypass
Social Share, Social Login and Social Comments Plugin – Super Socializer
≤7.10.6Update to 7.11
- Critical9.8PHP Object Injection
WP Job Manager
≤1.29.2Update to 1.29.3
- Medium6.1Cross-Site Scripting
trust-form
≤2.0.0Update to 2.0.1
- High7.5Sensitive Information Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.2.46Update to 2.2.50
- High7.5Information Disclosure
File Manager
≤5.0.0Update to 5.0.2
- High7.5Parameter Tampering
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.2.15Update to 3.2.15
- Critical9.8SQL Injection
WP Support Plus Responsive Ticket System
≤9.0.2Update to 9.0.3
- Medium6.1Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.2.14Update to 3.2.14
- Critical9.8Arbitrary File Upload
Deep Blue
≤1.9.2No patch available
- High8.8Cross-Site Request Forgery
Church Admin
<1.2550Update to 1.2550
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium4.8Cross-Site Scripting via image alt and title text
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.2.44Update to 2.2.45
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0Update to 2.0.4
- High7.2Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤14.5Update to 14.6
- Critical9.8App Showcase & App Store WordPress Theme < 1.2.1 - Missing Authorization to Arbitrary Options Update
Swape - App Showcase & App Store WordPress Theme
<1.2.1Update to 1.2.1
- Medium4.8Cross-Site Scripting via flickrRSS_set
flickrRSS
≤5.3.1No patch available
- Medium4.8Cross-Site Scripting via flickrRSS_tags
flickrRSS
≤5.3.1No patch available