Database
Critical WordPress vulnerabilities (page 1349)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Request Forgery
Timed Popup WordPress Plugin
≤1.4No patch available
- High8.8Cross-Site Request Forgery
Lightbox Photo Gallery
≤1.0No patch available
- High7.2Cross-Site Scripting
Simple visitor stat
≤1.0No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
WP-ViperGB
≤1.3.10Update to 1.3.11
- Critical9.8Arbitrary File Upload
WP Symposium
≤14.11Update to 15.1
- Medium4.3Cross-Site Request Forgery
W3 Total Cache
≤0.9.4Update to 0.9.4.1
- Medium6.3Cross-Site Request Forgery
twitter-liveblog
≤1.1.2No patch available
- Medium6.1Cross-Site Scripting
Simplelife
≤1.2No patch available
- Medium6.1Cross-Site Request Forgery
yurl-retwitt
≤1.4No patch available
- Medium6.1Cross-Site Request Forgery
bird-feeder
≤1.2.3No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
twitterDash
≤2.1No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Twimp WP
≤0.1No patch available
- High8.8Cross-Site Request Forgery
TweetScribe
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
<5.1.5Update to 5.1.5
- Critical9.8SQL Injection
Feedweb
≤3.0.7Update to 3.0.8
- Critical9.8Local File Inclusion
ChurcHope
≤2.1Update to 2.2
- Critical9.8Arbitrary File Upload
satoshi
≤2.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Broken Link Checker
<1.10.2Update to 1.10.2
- Medium5.3CAPTCHA Bypass
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms
<4.0.7Update to 4.0.7
- High8.8SQL Injection
Cart66 Lite :: WordPress Ecommerce
<1.5.2Update to 1.5.2
- Medium6.5Unauthenticated Arbitrary File Read
google-mp3-audio-player
≤1.0.11Update to 1.0.12
- Critical9.8Privilege Escalation
InfiniteWP Client
≤1.3.7Update to 1.3.8
- Critical9.8PHP Object Injection
InfiniteWP Client
≤1.3.7Update to 1.3.8
- Medium6.1Reflected Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<2.8.10Update to 2.8.10
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
≤2.0.6Update to 2.0.7
- High7.2JavaScript Injection
Rich Counter
<1.2.0Update to 1.2.0
- Medium5.3Full Path Disclosure
HTML5 MP3 Player with Playlist Free
≤2.7.0Update to 2.8.0
- Medium6.1Cross-Site Scripting
InstaSqueeze Sexy Squeeze Pages
all versionsNo patch available
- Low3.5Cross-Site Scripting
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤5.1.2Update to 5.1.3
- Medium6.1Cross-Site Scripting
WP Symposium
≤14.10Update to 14.11