Database
Critical WordPress vulnerabilities (page 1346)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injections
IP Blacklist Cloud
<3.41Update to 3.41
- Medium6.1Reflected Cross-Site Scripting
WP All Import Pro
≤4.1.1Update to 4.1.2
- High8.83.0.20 - Privilege Escalation
WP EasyCart: Shopping Cart and eCommerce Store
1.1.30 – 3.0.20Update to 3.0.21
- Critical9.8Arbitrary File Upload
Gravity Forms
<1.8.20Update to 1.8.20
- Medium6.1Cross-Site Scripting
WP Media Cleaner
≤2.2.6Update to 2.4.0
- Medium6.5Authenticated Cross-Site Scripting
Contact Form DB
≤2.8.26Update to 2.8.28
- High8.2Arbitrary Backup Creation and Download
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<0.5.10Update to 0.5.10
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Easy Social Icons
≤1.2.2Update to 1.2.3
- High8.8Blind SQL Injection
WonderPlugin Audio Player
≤2.0Update to 2.1
- High7.1Multiple Cross-Site Scripting
WonderPlugin Audio Player
<2.1Update to 2.1
- Medium6.1Reflected Cross-Site Scripting
PlusCaptcha
≤2.0.6Update to 2.0.14
- Medium5.4Reflected Cross Site Scripting
Image Metadata Cruncher
≤1.8No patch available
- Critical9.8Unauthenticated SQL Injection
SpiderCalendar
<1.4.10Update to 1.4.10
- High8.8Arbitrary File Upload
Fusion
≤3.1No patch available
- High7.5Brute Force Password Recovery Tokens
WordPress
<4.4Update to 4.4
- High8.8Unrestricted File Upload
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.6Update to 1.2.6
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
<2.8Update to 2.8
- Critical9.8Unauthenticated SQL Injection
CP Appointment Calendar
≤1.1.5Update to 1.1.6
- Medium6.1Cross-Site Request Forgery and Stored Cross-Site Scripting
Mobile Domain
≤1.5.2No patch available
- Medium5.4Cross-Site Scripting
Easing Slider
<2.2.0.7Update to 2.2.0.7
- Medium6.5Cross-Site Request Forgery to Site Reset
WordPress Uninstall
≤1.2.1No patch available
- Critical9.8Arbitrary File Upload
Cherry Plugin
<1.2.7Update to 1.2.7
- High8.8Multiple Cross-Site Request Forgery to Stored Cross-Site Scripting
Cross Slide
≤2.0.5No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Redirection Page
≤1.2No patch available
- Critical9.8SQL Injection
Store Locator for WordPress with Google Maps – LotsOfLocales
<3.34Update to 3.34
- High8.8Privilege Escalation
WPLMS Learning Management System for WordPress, WordPress LMS
≤1.8.4.1Update to 1.9
- Medium6.1Stored Cross-Site Scripting
FancyBox for WordPress
<3.0.3Update to 3.0.3
- Medium6.1Reflected Cross-Site Scripting
Fastly
≤0.97Update to 0.98
- Critical9.9Nonce Leak to Authorization Bypass
UpdraftPlus Premium
<1.9.51Update to 1.9.51
- Medium6.1Reflected Cross-Site Scripting
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
≤1.6.9Update to 1.7.0