Database
Critical WordPress vulnerabilities (page 1332)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
RoyalSlider
<3.2.7Update to 3.2.7
- Medium6.1Cross-Site Scripting
Replyable – Subscribe to Comments and Reply by Email
<1.4.6Update to 1.4.6
- Medium6.5Cross-Site Forgery Request and Reflected Cross-Site Scripting
eShop
≤6.3.13Update to 6.3.14
- Medium6.1Cross-Site Scripting
Fast Secure Contact Form
≤4.0.37Update to 4.0.38
- Medium6.1Reflected Cross-Site Scripting
WP Symposium
≤15.8.1Update to 15.9
- Medium6.1Cross-Site Scripting
Gallery – Photo Albums Plugin
<1.3.50Update to 1.3.50
- Medium6.6PHP Object Injection
SecureMoz Security Audit
≤1.0.5No patch available
- Critical9.8SQL Injection
WP Limit Login Attempts
<2.0.1Update to 2.0.1
- Medium6.3Cross-Site Request Forgery
Contact Form Generator : Creative form builder for WordPress
≤2.1.86Update to 2.5.0
- Critical9.8Remote File Inclusion
Memphis Documents Library
<3.0Update to 3.0
- Critical9.8Local File Inclusion
Memphis Documents Library
≤2.6.16Update to 3.0
- Medium6.1Cross-Site Scripting in Accept-Language Header
WPML Multilingual CMS
2.9.3 – 3.2.6Update to 3.2.7
- Critical9.8Remote File Inclusion via TimThumb
BJ Lazy Load
0.7.5 – 0.7.5Update to 1.0
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Testimonial Slider
≤1.2.5Update to 1.3.0
- Medium4.3Cross-Site Request Forgery
WatuPRO
<4.9.0.8Update to 4.9.0.8
- Medium6.4Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.9Update to 2.1.10
- Medium6.1Reflected Cross-Site Scripting
CKEditor for WordPress
≤4.5.3Update to 4.5.3.1
- Medium6.1Cross-Site Scripting
sourceAFRICA
≤0.1.3No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Responsive Thumbnail Slider
<1.0.1Update to 1.0.1
- Medium6.5Local File Inclusion
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.10Update to 2.1.15
- High7.5Insecure Direct Object Reference
Job Manager
≤0.7.25No patch available
- Medium6.1Stored Cross-Site Scripting
Captain Slider
≤1.0.6No patch available
- Medium6.1Reflected Cross-Site Scripting
SoundCloud Is Gold
<2.3.2Update to 2.3.2
- Critical9.8SQL Injection
Car Rental System
<3.1Update to 3.1
- Medium5.5Cross-Site Scripting
Embeds for YouTube
<3.3.3Update to 3.3.3
- Medium6.1Reflected Cross-Site Scripting
Navis DocumentCloud
<0.1.1Update to 0.1.1
- High8.8Multiple Cross-Site Request Forgery
Private Only
≤3.5.1No patch available
- High8.8SQL Injection
WordPress Meta Robots
≤2.1No patch available
- High8.8Authenticated Blind SQL Injection
GoCodes
≤1.3.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Simple Fields
<1.4.11Update to 1.4.11