Database
Critical WordPress vulnerabilities (page 1357)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Remote Code Execution
W3 Total Cache
≤0.9.2.8Update to 0.9.2.9
- Medium6.1Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.24Update to 2.0.25
- Medium6.1Cross-Site Scripting
WP-Table Reloaded
≤1.9.3Update to 1.9.4
- Critical9.1Path Disclosure and Denial of Service
Count per Day
≤3.2.3Update to 3.2.4
- Medium6.1Cross-Site Scripting
Count per Day
≤3.1Update to 3.1.1
- High7.5Local File Inclusion
WP AmASIN – The Amazon Affiliate Shop
≤0.9.6Update to 0.9.7
- Critical9.8Local/Remote File Inclusion
SlideDeck 2 Lite Responsive Content Slider
≤2.3.3Update to 2.3.5
- Medium6.1Cross-Site Scripting
Yoast Duplicate Post
≤2.6Update to 3.0
- Medium6.1Reflected Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
- Medium6.1Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.5.1Update to 5.5.2
- Medium6.1Cross-Site Scripting
HK Exif Tags
≤1.11Update to 1.12
- Critical9.8Arbitrary File Upload
Contact Form 7
≤3.5.2Update to 3.5.3
- Medium6.1Reflected Cross-Site Scripting
WPCB
≤2.4.8No patch available
- Medium6.1Cross-Site Scripting
WP Construction Mode
≤1.8Update to 1.9
- Critical9.8SQL Injection
WP eCommerce
≤3.8.9Update to 3.8.9.1
- Critical9.8Remote Code Execution
WP-Filebase
≤0.3.0.03Update to 0.3.0.04
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
<2.6Update to 2.6
- Medium5.3Information Disclosure
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps
<2.0.2Update to 2.0.2
- Medium5.4Cross-Site Scripting
WORDPRESS VIDEO GALLERY
≤2.5Update to 2.6
- Medium6.1JavaScript Code Injection
3CX Free Live Chat, Calls & Messaging
<4.1.0Update to 4.1.0
- Critical9.8Arbitrary Command Execution
WordPress Flash Uploader
<3.1.3Update to 3.1.3
- High7.5Sensitive Information Disclosure
WP BackItUp Community Edition
≤1.9Update to 1.9.1
- Medium6.1Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<1.1.66Update to 1.1.66
- Medium6.1Reflected Cross-Site Scripting
Compfight
≤1.4Update to 1.5
- Medium6.1Cross-Site Scrpting
Compfight
<1.5Update to 1.5