Database
Critical WordPress vulnerabilities (page 1329)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- High8.8Privilege Escalation
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- Medium6.1Multiple Cross-Site Scripting
eShop
≤6.3.14No patch available
- Medium5.4Open Redirect via wp_validate_redirect
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- High8.8Cross-Site Request Forgery
Simple add pages or posts
<1.7Update to 1.7
- Medium6.4Server-Side Request Forgery
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- High8.8Multiple SQL Injections
eShop
≤6.3.14No patch available
- Medium6.1Cross-Site Scripting
Connections Business Directory
<8.5.9Update to 8.5.9
- Medium6.4Cross-Site Scripting
Sola Support Tickets
<3.13Update to 3.13
- Critical9.8SQL Injection
Appointment Booking Calendar
≤1.2.24Update to 1.2.25
- Medium6.1Reflected Cross-Site Scripting
IMPress Listings
≤2.0.1Update to 2.0.2
- High8.8SQL Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤1.07.11Update to 2.0
- Critical9.8SQL Injection
Appointment Booking Calendar
<1.1.24Update to 1.1.24
- High7.5Authentication Bypass
OneLogin SAML SSO
<2.2.0Update to 2.2.0
- Critical9.9Missing Authorization
Simple Download Monitor
≤3.2.8Update to 3.2.9
- Critical9.1Missing Authorization
Download Manager
<2.8.8Update to 2.8.8
- Medium5.5Cross-Site Scripting via Theme Names
WordPress
≤4.4Update to 3.7.12 or 3.8.12 or 3.9.10 or 4.0.9 or 4.1.9 or 4.2.6 or 4.3.2 or 4.4.1
- Medium5.3Remote Code Execution
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
<1.1.4.6Update to 1.1.4.6
- Critical9.8SQL Injection
Simple Ads Manager
<2.9.5.118Update to 2.9.5.118
- High8.8Unrestricted File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.10Update to 2.1.15
- Medium6.4Stored Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- Medium6.5Cross-Site Request Forgery
mTouch Quiz
<3.1.3Update to 3.1.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
mTouch Quiz
<3.1.3Update to 3.1.3
- Medium6.1Reflected Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- High8.8SQL Injection
Welcart e-Commerce
<1.5.3Update to 1.5.3
- Medium4.3Missing Authorization Checks
Admin Management Xtended
≤2.4.0Update to 2.4.0.1
- Critical9.8SQL Injection
Smart External Link Click Monitor [Link Log]
<2.1Update to 2.1
- Medium6.1Cross-Site Scripting
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.2No patch available
- Medium6.4Cross-Site Scripting
Content text slider on post
<6.9Update to 6.9