Database
Critical WordPress vulnerabilities (page 1353)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.4Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters
All-In-One Security (AIOS) – Security and Firewall
<3.8.3Update to 3.8.3
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
I Recommend This – Love/Like Button for WordPress Posts
≤3.7.2Update to 3.7.3
- Medium4.3Reflected Cross-Site Scripting
MaxButtons – Create buttons
<1.26.1Update to 1.26.1
- Critical9.8SQL Injection
I Recommend This – Love/Like Button for WordPress Posts
<3.7.3Update to 3.7.3
- High7.3Authorization Bypass
MailPoet Newsletters (Previous)
≤2.6.7Update to 2.6.8
- Medium6.3Cross-Site Request Forgery
MailPoet Newsletters (Previous)
<2.6.11Update to 2.6.11
- Critical9.8Arbitrary File Upload
Konzept - Fullscreen Portfolio WordPress Theme
all versionsNo patch available
- Critical9.8SQL Injection
gallery-objects
≤0.4No patch available
- Medium5.3Improper Input Validation
WP-Ban
<1.64Update to 1.64
- High7.1Cross-Site Scripting
Login Widget With Shortcode
<3.2.1Update to 3.2.1
- Critical9.1Arbitrary File Deletion
FormCraft
≤2.0.5No patch available
- Medium6.3Multiple Cross-Site Request Forgery
Disqus Comment System
<2.79Update to 2.79
- Medium6.11.6.1 - Cross-Site Scripting
Cakifo
1.0 – 1.6.1Update to 1.6.2
- Critical9.8Missing Authorization
Custom Contact Forms
<5.1.0.4Update to 5.1.0.4
- High7.3Cross-Site Scripting via range Parameter
WooCommerce
<2.2.3Update to 2.2.3
- Medium5.3Full Path Disclosure
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- Critical9.8SQL Injection
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- Critical9.8Arbitrary File Download
Epic Church by Organized Themes
≤3.6No patch available
- High7.5Arbitrary File Download
Antioch
≤1.3No patch available
- High8.8Responsive Photo Gallery <= 1.0.7 - SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.0.7Update to 1.0.8
- High8.8Arbitrary File Upload
Slideshow Gallery LITE
<1.4.7Update to 1.4.7
- Medium5.3Security Bypass
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤2.9.2Update to 1.9.4 or 2.0.9 or 2.1.4 or 2.2.7 or 2.3.7 or 2.4.4 or 2.5.2 or 2.6.3 or 2.7.2 or 2.8.2 or 2.9.3
- Medium6.1Cross-Site Scripting
Memphis Documents Library
<3.0Update to 3.0
- High7.2Arbitrary File Overwrite
Access Governance for WordPress (aka AAM)
<2.8.3Update to 2.8.3
- Medium6.1Reflected Cross-Site Scripting
Iptanus File Upload
≤2.4.3Update to 2.4.4
- High7.5Directory Traversal
WP Source Control
<3.1.1Update to 3.1.1
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Improved user search in backend
≤1.2.5Update to 1.2.6
- Medium5.4Cross-Site Request Forgery
Disqus Comment System
<2.76Update to 2.76
- High8.3SQL Injection
GB Gallery Slideshow
<1.6Update to 1.6
- Medium6.1Cross-Site Scripting
MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps
<2.3.8Update to 2.3.8