Database
Critical WordPress vulnerabilities (page 1328)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Privilege Escalation
Bloom Email Opt-In
≤1.1.0Update to 1.1.1
- Critical9.1Missing Authorization Checks
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤2.0.21Update to 2.0.22
- Critical9.8Missing Authorization
WP e-Commerce – Store Exporter
≤1.6.6Update to 1.6.7
- Critical9.8Missing Authorization
WP e-Commerce – Store Toolkit
≤2.0.1Update to 2.0.2
- Critical9.8Missing Authorization Checks
Jigoshop – Store Toolkit
≤1.3.8Update to 1.3.9
- High7.2Multiple Vulnerabilities
mb.miniAudioPlayer – an HTML5 audio player for your mp3 files
≤1.7.6No patch available
- Critical9.8Missing Authorization
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
<1.8.4Update to 1.8.4
- High7.2Reflected Cross-Site Scripting
User Submitted Posts – Enable Users to Submit Posts from the Front End
<20160215Update to 20160215
- High8.8Privilege Escalation
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools
≤1.5.7Update to 1.5.8
- Medium6.1Cross-Site Scripting
Easy Contact Form Builder
≤1.0Update to 1.1
- Medium6.1Cross-Site Scripting
Recipes Writer
≤1.0.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Simplified Content
<1.0.1Update to 1.0.1
- Medium6.1Reflected Cross-Site Scripting
anti-plagiarism
≤3.60No patch available
- Medium6.1Reflected Cross-Site Scripting via title_az parameter
E-Search
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
new-year-firework
≤1.1.9No patch available
- Medium6.1Reflected Cross-Site Scripting
PhotoXhibit
≤2.1.8No patch available
- Medium6.1Reflected Cross-Site Scripting
ajax-random-post
≤2.00No patch available
- Medium6.1Reflected Cross-Site Scripting
Admin Font Editor
<1.8Update to 1.8
- Medium6.1Reflected Cross-Site Scripting
Pondol Form to Mail
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
heat-trackr
<1.01Update to 1.01
- Critical9.8Arbitrary File Upload
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
<2.3.11Update to 2.3.11
- High8.8Missing Authorization
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools
≤1.5.6Update to 1.5.7
- Critical9.8Blind SQL Injection
Booking Calendar Contact Form
<1.0.24Update to 1.0.24
- Medium6.1Reflected Cross-Site Scripting
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
- High8.1Shortcode SQL Injection
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
- Medium6.1Reflected Cross-Site Scripting
Elfsight Instagram Widget – Instagram Gallery
<1.1.2Update to 1.1.2
- Medium6.4Cross-Site Scripting
Universal Analytics
≤1.3.0Update to 1.3.1
- Medium6.5Unauthorized Settings Change
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
- Medium5.3Insecure Direct Object Reference
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1