Database
Critical WordPress vulnerabilities (page 1327)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Post Duplicator
≤2.16Update to 2.17
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.7Update to 4.0.7
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Lightbox Plus
≤2.7.2No patch available
- Medium6.1Cross-Site Scripting
WP Customer Reviews
<3.0.9Update to 3.0.9
- High7.2Stored Cross-Site Scripting
WP Cerber Security, Anti-spam & Malware Scan
<2.7Update to 2.7
- Medium6.1Cross-Site Scripting
ScoreMe
≤2016-04-01No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
WP Favorite Posts
≤1.6.5Update to 1.6.6
- High7.5Directory Traversal
Zedna eBook download
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Music Store – WordPress eCommerce
≤1.0.41Update to 1.0.43
- High7.5Local File Inclusion
IMDB Profile Widget
<1.0.9Update to 1.0.9
- High8.1Unauthenticated Local File Inclusion
Issuu Panel
<1.6.6No patch available
- High7.5Arbitrary File Download
Memphis Documents Library
≤3.1.5Update to 3.1.6
- Critical9.8Local/Remote File Inclusion
Brandfolder – Digital Asset Management Simplified.
<3.0.1Update to 3.0.1
- Critical9.8Local File Inclusion
A/B Test for WordPress
≤1.0.7No patch available
- High8.8Cross-Site Request Forgery via wp_ajax_wp_compression_test
WordPress
<4.5Update to 4.5
- High8.8Cross-Site Request Forgery & Arbitrary File Upload
Beauty & Clean
≤1.0.8No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
360 Product Rotation
≤1.2.0Update to 1.2.2
- Critical9.8Arbitrary File Upload
SP Project & Document Manager
≤2.6.1.3Update to 2.6.1.4
- Critical9.8SQL Injection
SP Project & Document Manager
≤2.5.9.5Update to 2.6.6.0
- Medium6.1Cross-Site Scripting
Ocim MP3
all versionsNo patch available
- Critical9.80.9.8.8 - Malicious Backdoor
Custom Content Type Manager
0.9.8.7 – 0.9.8.8Update to 0.9.8.9
- Medium6.1Reflected Cross-Site Scripting
Shibboleth
≤1.6Update to 1.7
- Critical9.8PHP Object Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.5.7Update to 2.5.8
- Medium6.1Reflected Cross-Site Scripting
Forget About Shortcode Buttons
≤1.1.1Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
Goodnews – Responsive WordPress News/Magazine | News / Editorial
≤5.11.1No patch available
- Critical9.8SQL Injection
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
≤1.1Update to 1.2
- Medium6.1Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<4.0.6Update to 4.0.6
- Medium6.1Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<4.0.5Update to 4.0.5
- High8.8Sensitive Information Disclosure
Bloom Email Opt-In
<1.1.0Update to 1.1.1
- High8.8Privilege Escalation
Divi Extra
≤1.2.3Update to 1.2.4