Database
Critical WordPress vulnerabilities (page 135)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Ultimate Gift Cards for WooCommerce
≤3.2.9Update to 3.2.10
- Medium6.1Reflected Cross-Site Scripting
IPGP Visitors Origin
<1.6Update to 1.6
- Medium5.3Unauthenticated Information Exposure
Tangible: Loops & Logic
≤4.2.0Update to 4.3.0
- Medium4.9Authenticated (Administrator+) SQL Injection
Quentn WP
≤1.2.14Update to 1.2.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
≤3.0.8Update to 3.0.9
- Medium4.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium5.3Unauthenticated Information Exposure
Payment Plugins for PayPal WooCommerce
≤2.0.25Update to 2.0.26
- Medium4.34.4.1 - Missing Authorization to Information Exposure
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
4.0.2 – 4.4.1Update to 4.4.2
- Medium6.50.1.8 - Unauthenticated Arbitrary Shortcode Execution
LukasApps CAPTCHA tools for Contact Form 7
0.1.7 – 0.1.8Update to 0.1.9
- Medium5.3Unauthenticated Insecure Direct Object Reference
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.6Update to 3.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
HT Menu – WordPress Mega Menu Builder for Elementor
<1.2.7Update to 1.2.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
JCH Optimize
<6.0.1Update to 6.0.1
- Medium4.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium5.3Missing Authorization
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.1Update to 4.4.2
- Medium6.1Unauthenticated Open Redirect
Groundhogg — CRM, Newsletters, and Marketing Automation
<4.7.2Update to 4.7.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Hustle – Email Marketing, Lead Generation, Optins, Popups
<7.8.14.2Update to 7.8.14.2
- Medium4.3Missing Authorization
Payment Plugins for PayPal WooCommerce
≤2.0.25Update to 2.0.26
- Medium5.3Unauthenticated Information Exposure
Payment Plugins for Stripe WooCommerce
≤4.0.11Update to 4.0.12
- High7.33.0.2 - Unauthenticated Privilege Escalation
SEO Flow by LupsOnline
3.0.0 – 3.0.2Update to 3.0.3
- High7.5Missing Authorization to Unauthenticated Stripe Credentials Update
Event Tickets and Registration
≤5.27.4Update to 5.27.4.1
- Medium5.3Unauthenticated Information Exposure
JetFormBuilder — Dynamic Blocks Form Builder
<3.6.5.2Update to 3.6.5.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Anti-Spam, Spam FireWall by CleanTalk
<6.87Update to 6.87
- High8.8Authenticated (Subscriber+) Arbitrary Account Email Takeover
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
<4.6.3Update to 4.6.3
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.1Update to 12.0.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.1Update to 12.0.2
- Medium5.3Missing Authorization
WP Travel – Ultimate Travel Booking System, Tour Management Engine
≤12.0.1Update to 12.0.2
- Medium5.4Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
Flamingo
≤2.6.2Update to 2.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
Powerkit – Supercharge your WordPress Site
≤3.0.4Update to 3.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder
<5.9.9Update to 5.9.9
- Medium5.3Missing Authorization to Unauthenticated Purchase Verification Bypass
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
≤3.1.7Update to 3.1.8