Database
Critical WordPress vulnerabilities (page 1339)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated Cross-Site Scripting
NewStatPress
≤0.9.8Update to 0.9.9
- High8.8Authenticated SQL Injection
NewStatPress
≤0.9.8Update to 0.9.9
- High8.8Authenticated SQL Injection
WordPress Landing Pages
<1.8.5Update to 1.8.5
- Medium6.1Reflected Cross-Site Scripting
TFO Graphviz
≤1.9Update to 1.10
- High7.2Stored Cross-Site Scripting
Free counter
≤1.1Update to 1.2
- Medium6.5Cross-Site Scripting
WordPress Landing Pages
<1.8.5Update to 1.8.5
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5.7Update to 5.5.7
- Medium6.1Stored Cross-Site Scripting
Church Admin
<0.810Update to 0.810
- Medium6.1Reflecte Cross-Site Scripting
woo-popup
≤1.2.2Update to 1.3.0
- Medium5.4Cross-Site Scripting
WP Membership
≤1.2.3No patch available
- High8.8Privilege Escalation
WP Membership
≤1.2.3No patch available
- High7.2Authenticated (Admin+) Remote Code Execution
Custom Content Type Manager
≤0.9.8.5Update to 0.9.8.6
- High7.1Cross-Site Scripting
WP Photo Album Plus
<6.1.3Update to 6.1.3
- Medium6.1Cross-Site Scripting
Polls CP
<1.0.5Update to 1.0.5
- High7.5Arbitrary File Download via Path Traversal
Simple Backup
<2.7.11Update to 2.7.11
- Critical9.8SQL Injection
FeedWordPress
<2015.0514Update to 2015.0514
- High8.8Cross-Site Request Forgery
Brute Force Login Protection
≤1.5.1No patch available
- Critical9.8Path Traversal to Remote Code Execution
My Calendar – Accessible Event Manager
≤2.3.29Update to 2.3.30
- Medium6.5Arbitrary Shortcode Execution
Awesome Support – WordPress HelpDesk & Support Plugin
<3.1.7Update to 3.1.7
- High7.5Sensitive Information Disclosure
Blessing Premium Responsive WordPress Theme
<1.3.2.1Update to 1.3.2.1
- High7.5Sensitive Information Disclosure
Diplomat | Political Campaign, Party, Blog Responsive WordPress Theme
≤1.0.1Update to 1.0.2
- High7.5Sensitive Information Disclosure
GamesTheme
≤1.0.3No patch available
- High7.5Sensitive Information Disclosure
Car Dealer Automotive WordPress Theme – Responsive
<1.1.9Update to 1.1.9
- High7.5Information Disclosure
SmartIT Premium Responsive
all versionsNo patch available
- Critical9.8Authenticated SQL Injection
BigContact Contact Page
<1.4.7Update to 1.4.7
- Critical9.8SQL Injection
wp-forum
≤2.4No patch available
- Critical9.8Arbitrary File Upload
Husker Portfolio
≤0.3No patch available
- High7.5Sensitive Information Disclosure
Accio | Responsive Onepage Parallax Site Template
<1.1.1Update to 1.1.1
- High7.5Sensitive Information Disclosure
Invento | Architecture Building Agency Template
≤2015-05-15No patch available
- High7.5Sensitive Information Disclosure
Accio | Responsive Onepage Parallax Agency WordPress Theme
≤1.1.0Update to 1.1.1