Database
Critical WordPress vulnerabilities (page 1324)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<1.9.19Update to 1.9.19
- Critical9.8Unauthenticated Arbitrary Options Update
Form Lightbox
≤2.1No patch available
- Medium6.1Cross-Site Scripting
dwnldr
≤1.0Update to 1.01
- Critical9.8Arbitrary File Upload
Frontend File Manager Plugin
<4.0Update to 4.0
- Medium5.8CSV Injection
CampTix Event Ticketing
<1.5Update to 1.5
- Medium6.1Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.4.2Update to 2.4.2
- Critical9.1Local File Inclusion
Easy Forms for Mailchimp
<6.1Update to 6.1
- Critical9.8SQL Injection
Photo Gallery by Ays – Responsive Image Gallery
<1.0.1Update to 1.0.1
- Critical9.1Local File Inclusion
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.65Update to 1.3.65
- Critical9.8Unauthenticated Arbitrary File Upload
BePro Listings
≤2.2.0020Update to 2.2.0021
- Medium4.3Authenticated Information Disclosure
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium5.4Missing Authorization
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Critical9.1Directory Traversal
Real3D Flipbook
≤1.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Real3D Flipbook
≤1.0.0No patch available
- High7.5Arbitrary File Upload
Advanced AJAX Page Loader
<2.7.7Update to 2.7.7
- High7.5File Upload to User Controlled Location
Real3D Flipbook
≤1.0.0No patch available
- Critical10.0Unauthenticated Arbitrary File or Directory Delete
Real3D Flipbook
<2.9Update to 2.9
- Medium6.1Cross-Site Scripting
ColorWay
≤3.4.1Update to 3.4.2
- Medium6.1Cross-Site Scripting via a ticket excerpt.
SupportFlow
<0.7Update to 0.7
- Critical9.8Authentication Bypass
MemberSonic Lite Membership Site Plugin
≤1.2Update to 1.302
- High8.1Object Injection
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Critical9.8Authentication Bypass
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- Medium6.1Cross-Site Scripting
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- Medium6.1Reflected Cross-Site Scripting
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.9.0Update to 3.9.0
- Critical9.8Remote File Upload
contus-video-comments
≤1.0No patch available
- High8.8Privilege Escalation
Community by PeepSo – Download from PeepSo.com
≤1.6.0Update to 1.6.1
- High7.2Stored Cross-Site Scripting via discussion ticket title
SupportFlow
≤0.6Update to 0.7
- Medium6.1Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.4Update to 4.0.4
- High7.3Bypass sanitize_file_name Protection
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3