Database
Critical WordPress vulnerabilities (page 1344)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3SQL Injection
WP Symposium
<15.4Update to 15.4
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
≤2.8Update to 2.8.1
- Medium6.1Cross-Site Scripting
My Wish List
<1.4.2Update to 1.4.2
- Critical9.8Arbitrary File Upload
Website Contact Form With File Upload
≤1.3.4Update to 1.4
- Critical9.8SQL Injection
cformsII
<14.6.10Update to 14.6.10
- Critical9.8Arbitrary File Upload/Deletion
Easy Digital Downloads – Upload File
≤1.0.3Update to 1.0.4
- Critical9.8Arbitrary File Upload
Windows Desktop and iPhone Photo Uploader
≤1.8No patch available
- Medium6.4Cross-Site Scripting via example.html
WordPress
≤4.2.1Update to 3.7.8 or 3.8.8 or 3.9.6 or 4.0.5 or 4.1.5 or 4.2.2
- High8.8TheCartPress eCommerce Shopping Cart <= 1.5.3.6 Cross-Site Request Forgery
TheCartPress eCommerce Shopping Cart
≤1.5.3.6No patch available
- Medium5.4Authenticated (Subscriber+) Cross-Site Scripting
Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic
<7.6.1.0Update to 7.6.1.0
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<3.9.1Update to 3.9.1
- High7.5Arbitrary File Download
Aspose Importer & Exporter (Discontinued)
≤2.0Update to 3.0
- Medium5.3Information Disclosure
Simple Ads Manager
≤2.5.96Update to 2.5.97
- Critical10.0Multiple SQL Injections
Simple Ads Manager
<2.7.97Update to 2.7.97
- Critical9.8Arbitrary File Upload
PHP Event Calendar for WordPress
<1.5.1Update to 1.5.1
- Critical9.8Arbitrary File Upload
Simple Ads Manager
≤2.5.94Update to 2.5.96
- Critical9.8SQL Injection
WP Business Intelligence Lite
≤1.6.2Update to 1.6.3
- High7.1Reflected Cross-Site Scripting
Favicon by RealFaviconGenerator
<1.2.13Update to 1.2.13
- Medium5.3Information Disclosure
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<2.2.6Update to 2.2.6
- Critical9.8Unrestricted File Upload leading to Remote Code Execuction
Webcam Video Conference
≤4.91.8Update to 4.91.9
- Critical9.8Arbitrary File Upload
VideoWhisper Video Presentation
≤4.1.4Update to 4.6.1
- High7.5Arbitrary File Download
Aspose.PDF Exporter
<2.0Update to 2.0
- High7.5Unauthenticated Arbitrary File Read
Aspose.Words – Import and Export word documents
≤1.0Update to 2.0
- High7.1Cross-Site Scripting
flashy
≤1.3No patch available
- High8.8Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<2.0.77.3Update to 2.0.77.3
- High8.8Cross-Site Request Forgery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<2.0.77.3Update to 2.0.77.3
- Critical9.8Arbitrary File Upload
InBoundio Marketing
<2.0.1Update to 2.0.1
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
AB Google Map Travel (AB-MAP)
<4.0Update to 4.0
- High8.8Arbitrary File Download
WP Marketplace – Complete Shopping Cart / eCommerce Solution
<2.4.1Update to 2.4.1
- Medium6.5Path Traversal
WP Marketplace – Complete Shopping Cart / eCommerce Solution
<2.4.1Update to 2.4.1