Database
Critical WordPress vulnerabilities (page 1330)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Role Scoper (Obsolete – Please install PublishPress Permissions)
<1.3.67Update to 1.3.67
- High8.8Cross-Site Request Forgery
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.29Update to 1.3.29
- Medium5.4Cross-Site Scripting via p_name parameter
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- Medium6.1Cross-Site Scripting
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
- High8.8Authenticated Command Injection
Cool Video Gallery
<2.0Update to 2.0
- High8.8Authenticated Blind SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.64Update to 1.5.64
- Critical9.8SQL Injection
Google Doc Embedder
<2.5.17Update to 2.5.17
- Medium6.1Reflected Cross-Site Scripting
Auto Thickbox Plus
≤1.9No patch available
- Critical9.8SQL Injection
Double Opt-In for Download
<2.0.9Update to 2.0.9
- Medium6.1Reflected Cross-Site Scripting
Websimon Tables
≤1.3.4No patch available
- Critical9.8SQL Injection
Google Map
<2.2.6Update to 2.2.6
- High7.2Authenticated SQL Injection
WP-Stats-Dashboard
≤2.9.4No patch available
- High7.2Authenticated (Admin+) SQL Injection
Watu Quiz
≤2.6.7Update to 2.6.8
- High8.8Arbitrary File Upload
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.59Update to 1.5.59
- Critical9.8SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.8.4.9Update to 0.8.4.9
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.2.5Update to 2.2.5
- High8.8Cross-Site Request Forgery
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- Medium6.1Cross-Site Scripting
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Medium6.1Cross-Site Scripting
WordPress Calls to Action
<2.5.1Update to 2.5.1
- Critical9.0Remote File Inclusion
Gwolle Guestbook
<1.5.4Update to 1.5.4
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.4.1Update to 3.4.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Crony Cronjob Manager
<0.4.7Update to 0.4.7
- Critical9.8SQL Injection
Visitors Online by BestWebSoft
≤0.3Update to 0.4
- High8.8SQL Injection
wp-championship
<5.9Update to 5.9
- High8.8Authenticated SQL Injection
Dynamic Widgets
≤1.5.10Update to 1.5.11
- Medium6.1Cross-Site Scripting
Connect Matomo – Analytics Dashboard for WordPress
<1.0.5Update to 1.0.5
- Medium6.1Cross-Site Scripting
Akismet Anti-spam: Spam Protection
<3.1.5Update to 3.1.5