Database
Critical WordPress vulnerabilities (page 1310)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
WP Customer Area
<7.4.3Update to 7.4.3
- Medium6.1Reflected Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤5.7.1Update to 5.8.0
- High8.8Authenticated SQL Injection
inlinks
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Emag Marketplace Connector
<1.0.1Update to 1.0.1
- Medium5.4Cross-Site Scripting
amtyThumb posts
≤8.2.0No patch available
- High8.8Authenticated PHP Object Injection
WooCommerce
<3.2.4Update to 3.2.4
- Medium6.4Stored Cross-Site Scripting
Affiliate Ads for Clickbank Products
≤1.6Update to 1.7
- High8.3Unauthenticated Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
- Medium5.3Unauthenticated Information Disclosure
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
- Critical9.8Authentication Bypass
UserPro - Community and User Profile WordPress Plugin
<4.9.17.1Update to 4.9.17.1
- Medium6.1Cross-Site Scripting
Simple Membership
<3.5.7Update to 3.5.7
- Medium6.1Reflected Cross-Site Scripting
Ultimate Instagram Feed – WordPress Plugin
<1.3Update to 1.3
- Medium6.1Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.28Update to 1.2.30
- Medium6.1Cross-Site Scripting
Content Cards
≤0.9.6Update to 0.9.7
- Medium6.1Cross-Site Scripting
Football Pool
<2.6.5Update to 2.6.5
- High8.8SQL Injection
JTRT Responsive Tables
<4.1.2Update to 4.1.2
- High8.8Authenticated Remote Code Execution
Shortcodes Ultimate – Content Elements
<5.0.1Update to 5.0.1
- Critical9.8SQL Injection due to Double Prepare approach
WordPress
≤4.8.2Update to 3.7.23 or 3.8.23 or 3.9.21 or 4.0.20 or 4.1.20 or 4.2.17 or 4.3.13 or 4.4.12 or 4.5.11 or 4.6.8 or 4.7.7 or 4.8.3
- Medium6.1Cross-Site Scripting
User Login History
<1.6Update to 1.6
- Critical9.8SQL Injection to PHP Object Injection
Contact Form for WordPress – Ultimate Form Builder Lite
<1.3.7Update to 1.3.7
- Medium6.1Cross-Site Scripting
Easy Appointments
<1.12.0Update to 1.12.0
- Medium6.1Reflected Cross-Site Scripting
External Media without Import
<1.0.0Update to 1.0.0
- Critical9.8PHP Object Injection
Invite Anyone
≤1.3.18Update to 1.3.19
- Medium6.1Reflected Cross-Site Scripting
PopCash Code Integration Tool
<1.1Update to 1.1
- Medium5.4Reflected Cross-Site Scripting
pootle button
≤1.1.1Update to 1.2.0
- Medium6.1Authenticated Cross-Site Scripting
Max Mega Menu
≤2.3.8Update to 2.4
- High7.2Stored Cross-Site Scripting
Quards
all versionsNo patch available
- Medium4.7Cross-domain Flash injection
WordPress
≤4.9.1Update to 3.7.25 or 3.8.25 or 3.9.24 or 4.0.22 or 4.1.22 or 4.2.19 or 4.3.15 or 4.4.14 or 4.5.13 or 4.6.10 or 4.7.9 or 4.8.5 or 4.9.2
- Critical9.8SQL Injection
Simple Login Log
<1.1.2Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
My WP Translate
≤1.0.3Update to 1.0.4