Database
Critical WordPress vulnerabilities (page 1337)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
WTI Like Post
<1.4.3Update to 1.4.3
- Critical9.8SQL Injection
Broken Link Manager
<0.5.0Update to 0.5.0
- Medium6.1Cross-Site Scripting
Broken Link Manager
≤0.4.5Update to 0.5.0
- High7.5Directory Traversal
MDC YouTube Downloader
<2.1.1Update to 2.1.1
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.0.0Update to 3.0.0
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- Critical9.1Path Traversal
Image Export
≤1.1Update to 1.1.1
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- High7.2Stored Cross-Site Scripting
NewStatPress
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Broken Link Checker
<1.10.9Update to 1.10.9
- High8.8Cross-Site Request Forgery
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- Medium6.1Cross-Site Scripting
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- Critical9.8SQL Injection
Powerplay Gallery
≤3.3No patch available
- High7.5Directory Traversal
download-zip-attachments
≤1.0No patch available
- High8.8Arbitrary Options Update
Pont - Multipurpose Wordpress Theme | Business
≤1.5No patch available
- High8.8Arbitrary Options Update
Vernissage - Photography WordPress Theme
≤1.2.9Update to 1.3
- High8.8Fullscreen Photography Theme | Portfolio <= 1.8.5 - Arbitrary Options Update
Teardrop - Fullscreen Photography Theme | Portfolio
≤1.8.5Update to 1.8.6
- High8.8Fullscreen Portfolio & Blog HTML Theme <= 1.3.2 - Arbitrary Options Update
Simpolio - Fullscreen Portfolio & Blog HTML Theme
≤1.3.2No patch available
- Critical9.8Unauthenticated SQL Injection
Email Newsletter
≤20.15No patch available
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
≤1.0.6Update to 1.0.7
- Medium6.1Reflected Cross-Site Scripting
Nextend Twitter Connect
≤1.5.1Update to 1.5.2
- Medium6.1Reflected Cross-Site Scripting
Nextend Social Login and Register
<1.5.6Update to 1.5.6
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
WP Accurate Form Data
≤1.2No patch available
- High8.8Cross-Site Request Forgery
Analyticator
<6.4.9.4Update to 6.4.9.4
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Erident Custom Login Page & Dashboard
≤3.4.1Update to 3.5
- Medium4.3Cross-Site Request Forgery
WP-Stats
<2.52Update to 2.52
- Medium6.1Cross-Site Scripting
WordPress Landing Pages
≤1.8.7Update to 1.8.8
- Medium6.1Cross-Site Scripting
Altos Connect
≤1.3.0No patch available
- High8.6Directory Traversal
Zip Attachments
≤1.5Update to 1.5.1
- High7.5Path Traversal
WordPress Renaming Tool by Vlajo
≤1.0No patch available