Database
Critical WordPress vulnerabilities (page 1345)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.1SQL Injection
Gravity Forms
≤1.9.3.5Update to 1.9.3.6
- Critical9.8SQL Injection
Pods – Custom Content Types and Fields
<2.5.1.2Update to 2.5.1.2
- Critical9.8Arbitrary File Upload
ReFlex Gallery » WordPress Photo Gallery
<3.1.4Update to 3.1.4
- Critical9.8SQL Injection
Knews Multilingual Newsletters
≤1.7.0Update to 1.7.1
- Critical9.8Arbitrary File Upload
Work The Flow File Upload
≤2.5.2Update to 2.5.3
- Medium5.4Authenticated Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.13Update to 1.2.13
- High7.2Stored Cross-Site Scripting
WooCommerce
<2.3.6Update to 2.3.6
- Critical9.8SQL Injection
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.2.5Update to 3.2.5
- High7.2Authenticated (Admin+) SQL Injection
Responsive Slider – Image Slider – Slideshow for WordPress
<2.7.0Update to 2.7.0
- High8.8Blind SQL Injection
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤1.7.3Update to 1.5.7 or 1.6.4 or 1.7.4
- Medium6.1Cross-Site Scripting
wpml
<3.1.9Update to 3.1.9
- Critical9.8SQL Injection
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.2.0Update to 3.2.0
- Critical9.8Arbitrary Options Update
Faction
≤1.1.1No patch available
- High7.5Arbitrary Deletion of Content
WPML Multilingual CMS
≤3.1.9Update to 3.1.9.1
- High7.5Cross-Site Request Forgery
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤1.7.3.3Update to 1.5.7 or 1.6.4 or 1.7.4
- Critical9.8SQL Injection via lang Parameter
WPML Multilingual CMS
≤3.1.9Update to 3.1.9.1
- Critical9.8Authorization Bypass to Arbitrary File Upload/Delete
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.0.84Update to 1.0.84
- Critical9.8Arbitrary File Upload
WPshop 2 – E-Commerce
<1.3.9.6Update to 1.3.9.6
- Critical9.8Authentication Bypass
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
<2.0.9.2Update to 2.0.9.2
- Critical9.8SQL Injection
Daily Edition
≤1.6.2No patch available
- Critical9.8Arbitrary File Upload
Daily Edition
≤1.6.2Update to 1.6.3
- Medium4.9Authenticated (Admin+) Path Traversal
IP Blacklist Cloud
≤3.42Update to 3.43
- Critical9.0SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<3.8.8Update to 3.8.8
- Low3.1Cross-Site Request Forgery
All-In-One Security (AIOS) – Security and Firewall
≤3.8.9Update to 3.9.0
- Critical9.8Arbitrary File Upload
DesignFolio Pllus
all versionsNo patch available
- Critical9.8Privilege Escalation
Ya'aburnee - Magazine & E-Commerce Theme | News / Editorial
≤1.0.7No patch available
- Medium4.3Cross-site request forgery via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php
Contact Form DB
≤2.8.29Update to 2.8.32
- Medium5.3CAPTCHA Bypass
reCaptcha by BestWebSoft
<1.13Update to 1.13
- Medium5.4Authorization Bypass
WPML Multilingual CMS
<3.1.9Update to 3.1.9.1
- Critical9.8Cross-Site Request Forgery to SQL Injection
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤1.0.11Update to 1.0.12