Database
Critical WordPress vulnerabilities (page 1367)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5Update to 5.5
- Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.51Update to 3.52
- Medium6.1Cross-Site Scripting
HMS Testimonials
<2.0.11Update to 2.0.11
- High7.1Cross-Site Request Forgery
HMS Testimonials
<2.0.11Update to 2.0.11
- High7.2Cross-Site Scripting via sort Parameter
Download Monitor
<3.3.6.2Update to 3.3.6.2
- Medium6.1Cross-Site Scripting via p Parameter
Download Monitor
<3.3.6.2Update to 3.3.6.2
- Medium6.1Reflected Cross-Site Scripting
Category Grid View Gallery
≤2.3.1Update to 2.3.2
- Critical9.8SQL Injection
js-restaurant
all versionsNo patch available
- Medium6.1Cross-Site Scripting
BuddyPress Extended Friendship Request
<1.0.2Update to 1.0.2
- Critical9.8Multiple Vulnerabilities
RokMicroNews
≤1.5Update to 1.6
- Medium6.1DOM Cross-Site Scripting
Xorbin Digital Flash Clock
≤1.0No patch available
- High8.8Cross-Site Request Forgery
qTranslate
≤2.5.39No patch available
- Medium6.4Cross-Site Scripting via Multiple Vectors
WordPress
≤3.5.1Update to 3.5.2
- Medium4.6Content-Spoofing Attacks
WordPress
≤3.5.1Update to 3.5.2
- Medium5.4Server Side Request Forgery
WordPress
≤3.5.1Update to 3.5.2
- Medium5.4XXE Injection
WordPress
≤3.5.1Update to 3.5.2
- Medium6.3Missing Authorization Checks
WordPress
≤3.5.1Update to 3.5.2
- Medium4.3Sensitive Information Disclosure
WordPress
≤3.5.1Update to 3.5.2
- Medium5.3Denial of Service via wp-postpass cookie
WordPress
<3.5.2Update to 3.5.2
- Medium6.4Cross-Site Scripting
WordPress
≤3.5.1Update to 3.5.2
- Critical10.0Multiple Vulnerabilities
Slash WP
all versionsNo patch available
- Critical9.8Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤1.9.12Update to 1.9.13
- Medium5.4Missing Authorization Checks & Cross-Site Request Forgery
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<1.8.8Update to 1.8.8
- Medium5.3Information Exposure
WordPress Exit Strategy
≤1.55Update to 1.59
- Medium4.3Cross-Site Request Forgery
WordPress Exit Strategy
≤1.55Update to 1.59
- Medium4.3Cross-Site Request Forgery
WordPress Exit Box Lite
≤1.06Update to 1.10
- Medium5.3Full Path Dislcosure
WordPress Exit Box Lite
1.06 – 1.06Update to 1.10
- Medium6.1Cross-Site Scripting
Social Sharing Toolkit
<2.1.2Update to 2.1.2
- Critical9.8SQL Injection
Flagallery-skins
≤1.1.5No patch available
- Medium6.3Cross-Site Request Forgery
digg-digg
<5.3.5Update to 5.3.5