Database
Critical WordPress vulnerabilities (page 134)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
IMPress for IDX Broker
≤3.3.0Update to 3.3.1
- Medium5.3Unauthorized WordPress Account Creation
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
<4.7.0Update to 4.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
CoolClock
≤4.3.7Update to 4.3.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
EventON – Events Calendar
≤2.5.7Update to 2.5.8
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.3.7No patch available
- High7.36.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤19.2Update to 19.3 or 6.3.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting
Graphina – Charts and Graphs For Elementor
≤3.1.11Update to 3.1.12
- High7.3Unauthenticated Privilege Escalation
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
≤6.1.5Update to 6.1.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.6.0Update to 5.6.4
- Medium5.3Missing Authorization
Hungarian Pickup Points & Shipping Labels for WooCommerce
<4.2.8Update to 4.2.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Open User Map – Interactive Leaflet Maps
≤1.4.50Update to 1.4.51
- Medium4.3Missing Authorization
Unbounce Landing Pages
≤1.1.4Update to 1.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.5.1Update to 3.6.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Appointments
≤4.0.2.1No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Hide My WP Ghost – Security & Firewall
≤7.0.09Update to 7.0.10
- High7.5Unauthenticated Denial of Service
WooCommerce
<11.1.0Update to 11.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.17Update to 2.0.18
- High7.5Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter
WP Fusion (Pro)
≤3.47.13Update to 3.47.14
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.9.27Update to 5.9.28
- High7.5Unauthenticated SQL Injection
Music Store – WordPress eCommerce
<1.4.5Update to 1.4.5
- High7.1Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter
EDD Product Catalog Feed by PixelYourSite
≤1.0.2Update to 1.0.3
- High8.8Authenticated (Contributor+) PHP Object Injection via Shortcode
Live Composer – Free WordPress Website Builder
≤2.1.18Update to 2.1.19
- Medium5.3Unauthenticated Payment Bypass
WP Express Checkout (Fast Payments via PayPal & Stripe)
≤2.4.0Update to 2.5.0
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter
Zephyr Project Manager
≤3.3.205Update to 3.3.206
- Medium6.5Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
WPML Multilingual CMS
≤4.9.5Update to 4.9.6
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.10.3.1Update to 2.10.3.2
- High7.5Unauthenticated SQL Injection
ELEX WooCommerce Request a Quote
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.3.9.1Update to 4.4.0
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
Online Scheduling and Appointment Booking System – Bookly
≤27.2Update to 27.3
- Medium5.33.5.2 - Unauthenticated Ticket Attachment Read
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
3.2.9 – 3.5.2Update to 3.5.3