Database
Critical WordPress vulnerabilities (page 1335)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated SQL Injection
SendPress Newsletters
<1.2Update to 1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WordPress
≤4.2.2Update to 3.7.9 or 3.8.9 or 3.9.7 or 4.0.6 or 4.1.6 or 4.2.3
- Medium6.5Authorization Bypass
WordPress
≤4.2.2Update to 3.7.9 or 3.8.9 or 3.9.7 or 4.0.6 or 4.1.6 or 4.2.3
- High7.2Authenticated Blind SQL Injection
Microblog Poster – Auto Publish on Social Media
<1.6.2Update to 1.6.2
- Medium6.1Multiple Cross-Site Scripting
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<1.8.4.3Update to 1.8.4.3
- Medium6.1Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<4.1.6.1Update to 4.1.6.1
- High7.2Cross-Site Request Forgery
Count per Day
<3.4.1Update to 3.4.1
- Medium6.3Cross-Site Request Forgery
Portfolio Plugin
<1.05Update to 1.05
- High7.5Sensitive Information Exposure
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps
<2.1.3Update to 2.1.3
- High7.5Arbitrary File Download
wptf-image-gallery
≤1.0.3No patch available
- Critical9.8SQL Injection
Plugmatter Optin Feature Box
<2.0.14Update to 2.0.14
- Critical9.8SQL Injection
NEX-Forms – Ultimate Forms Plugin for WordPress
<4.6.1Update to 4.6.1
- Critical9.8SQL Injection
Plugmatter Optin Feature Box
<2.0.14Update to 2.0.14
- Medium6.1Cross-Site Scripting
Broken Link Manager
<0.6.0Update to 0.6.0
- High7.5Arbitrary File Download
WP Attachment Export
<0.2.4Update to 0.2.4
- Critical9.8SQL Injection
Auto Affiliate Links
<5.0Update to 5.0
- High8.8Authenticated SQL Injection
Smooth Slider
≤2.6.5Update to 2.7
- High7.1Multiple Cross-Site Scripting
Welcart e-Commerce
<1.4.18Update to 1.4.18
- High7.2Local File Includion
Subscribe to Comments
≤2.1.2Update to 2.3
- High8.8Cross-Site Request Forgery
BuddyPress Activity Plus
≤1.5Update to 1.6.2
- Critical9.8WordPress Chat Plugin < 1.0.3 - SQL Injection
FrieChat - WordPress Chat Plugin
<1.0.3Update to 1.0.3
- Medium6.1Cross-Site Scripting
The Events Calendar: Eventbrite Tickets
<3.10.2Update to 3.10.2
- High7.5Directory Traversal
Recent Backups
≤0.7No patch available
- Critical9.8Arbitrary File Upload
WPE Indoshipping
≤2.5.0No patch available
- Medium6.4Stored Cross-Site Scripting
Plotly
<1.0.3Update to 1.0.3
- Medium6.4Stored Cross-Site Scripting
Plotly
≤1.0.2Update to 1.0.3
- Critical9.8Unauthenticated Arbitrary File Upload
WP Front-End Repository Manager
≤1.1No patch available
- Medium5.3Full Path Disclosure
MP3-jPlayer
<2.5Update to 2.5
- High7.5Arbitrary File Download
candidate-application-form
≤1.3No patch available
- Critical9.8Blind SQL Injection
filedownload
<1.4Update to 1.4