Database
Critical WordPress vulnerabilities (page 1352)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
cforms
<10.5Update to 10.5
- Medium6.1Cross-Site Scripting
cforms
≤10.1Update to 10.2
- Medium6.1Reflected Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<6.0.27Update to 6.0.27
- Critical9.8SQL Injection
YourMembers
≤3.0No patch available
- High8.8Command Injection
WP-DBManager
<2.72Update to 2.72
- Medium6.5Arbitrary File Read
WP-DBManager
<2.7.2Update to 2.7.2
- High7.8OS Command Injection
WP-DBManager
<2.72Update to 2.72
- Critical9.8Arbitrary File Upload
Work The Flow File Upload
≤2.3.1Update to 2.3.2
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Simple Sticky Footer
≤1.3.2Update to 1.3.3
- Medium6.1Cross-Site Scripting
Contact Form DB
≤2.8.19Update to 2.8.20
- Medium6.1Reflected Cross-Site Scripting
EWWW Image Optimizer
≤2.0.1Update to 2.0.2
- Medium6.1Reflected Cross-Site Scripting
Simple Calendar – Google Calendar, Events, & ICS Feeds
<2.0.4Update to 2.0.4
- Medium6.1Reflected Cross-Site Scripting
Titan Framework
<1.6Update to 1.6
- High8.8SQL Injection
BulletProof Security
<.51.1Update to .51.1
- Critical9.8Unspecified Vulnerability
enfold
<3.0.1Update to 3.0.1
- Medium5.31.3.10 - Multiple Cross-Site scripting
Contact Form 7 Integrations
1.0 – 1.3.10Update to 1.3.11
- Critical9.81.5.10 - Arbitrary File Upload
Infusionsoft Gravity Forms Add-on
1.5.3 – 1.5.10Update to 1.5.11
- Critical9.8SQL Injection
WP eCommerce
<3.8.7.6Update to 3.8.7.6
- Medium6.1Stored Cross-Site Scripting
Subscribe2 – Form, Email Subscribers & Newsletters
<10.16Update to 10.16
- High7.2Authenticated (Admin+) SQL Injection
Content Audit
<1.6.1Update to 1.6.1
- Low3.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.1.30Update to 1.1.31
- Medium4.8Cross-Site Scripting
BulletProof Security
<.52.5Update to .52.5
- Critical9.8Arbitrary File Upload and Deletion
Category and Page Icons
≤0.9.1Update to 0.9.2
- High7.5Unauthenticated Arbitrary File Read
NativeChurch
≤1.6.1Update to 1.6.2
- Medium6.1Multiple Cross-Site Scripting
bSuite
≤5 alpha 2Update to 5 alpha 3
- Critical10.0Multiple Vulnerabilities
Refraction
≤1.3No patch available
- Medium6.1Multiple Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
- Medium5.3Directory Traversal
Tom M8te
all versionsNo patch available
- High7.25.0.6 - Cross-Site Scripting
Easy Forms for Mailchimp
3.0 – 5.0.6Update to 5.0.7
- High8.8Arbitrary File Upload
Frontend File Manager Plugin
<3.6Update to 3.6