Database
Critical WordPress vulnerabilities (page 18)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Privilege Escalation
OAuth Single Sign On – SSO (OAuth Client)
≤7.1.3Update to 7.1.4
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.62Update to 2.8.63
- Medium4.3Missing Authorization
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
≤2.11.2Update to 2.11.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
<5.0.0Update to 5.0.0
- Medium5.3Missing Authorization
EventPrime – Events Calendar, Bookings, Tickets & AI
<4.3.6.1Update to 4.3.6.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Premium Packages – Sell Digital Products Securely
<7.3.1Update to 7.3.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Premium Packages – Sell Digital Products Securely
<7.3.1Update to 7.3.1
- Medium5.3Missing Authorization
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤6.0.6Update to 6.0.7
- Medium4.34.2.0 - Authenticated (Subscriber+) Information Exposure
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
3.9.0 – 4.2.0Update to 4.3.1
- Medium4.34.2.0 - Missing Authorization
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
3.6.0 – 4.2.0Update to 4.3.1
- Medium5.3Missing Authorization
MC4WP: Mailchimp for WordPress
≤4.14.0Update to 4.15.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
MC4WP: Mailchimp for WordPress
≤4.14.0Update to 4.15.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Anti-Spam, Spam FireWall by CleanTalk
≤6.90Update to 6.91
- Medium4.9Authenticated (Administrator+) Path Traversal
WPvivid — Backup, Migration & Staging
<0.9.138Update to 0.9.138
- Medium5.3Missing Authorization
WP Roster
<2.36Update to 2.36
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Text Typing – grab attention with animated typing headlines
<2.2.2Update to 2.2.2
- Medium4.9Authenticated (Administrator+) Path Traversal
WPvivid — Backup, Migration & Staging
<0.9.137Update to 0.9.137
- Low2.7Authenticated (Administrator+) Arbitrary Database Table Deletion
WPvivid — Backup, Migration & Staging
<0.9.137Update to 0.9.137
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Enable Media Replace
<4.2.3Update to 4.2.3
- High7.5Unauthenticated SQL Injection
GS JWT Authentication for WP REST API
≤1.0.0No patch available
- Medium5.3Unauthenticated Full Path Disclosure
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<5.1.0Update to 5.1.0
- Medium5.3Unauthenticated Information Exposure
WP Remote Users Sync
<2.2.0Update to 2.2.0
- Medium4.3Missing Authorization
Post Duplicator
<3.0.17Update to 3.0.17
- Medium4.35.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Essential Real Estate
4.4.3 – 5.3.4Update to 5.3.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)
≤6.8.10Update to 6.8.11
- Medium6.43.1.2 - Authenticated (Contributor+) Server-Side Request Forgery
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
2.10.0 – 3.1.2Update to 3.1.3
- Medium4.37.5.56.7211 - Missing Authorization
FV Flowplayer Video Player
7.4.44.727 – 7.5.56.7211Update to 7.5.56.7212
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
FV Flowplayer Video Player
<7.5.56.7212Update to 7.5.56.7212
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
SEOPress – AI SEO Plugin & On-site SEO
<10.4Update to 10.4
- Medium5.3Missing Authorization
Mollie Payments for WooCommerce
<8.2.0Update to 8.2.0