Database
Critical WordPress vulnerabilities (page 21)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Photo Album Plus
≤9.3.05.003Update to 9.3.06.001
- Medium6.48.9.0 - Authenticated (Author+) Stored Cross-Site Scripting
EWWW Image Optimizer
8.7.4 – 8.9.0Update to 8.9.1
- Medium4.3Authenticated (Customer+) Insecure Direct Object Reference
Essential Real Estate
≤5.3.4Update to 5.3.5
- Medium4.3Missing Authorization
Essential Real Estate
≤5.3.4Update to 5.3.5
- Medium5.3Missing Authorization
Essential Real Estate
≤5.3.4Update to 5.3.5
- Medium5.3Unauthenticated Information Exposure
Essential Real Estate
≤5.3.4Update to 5.3.5
- Medium5.3Unauthenticated Gift Card Balance Double-Spending
YITH WooCommerce Gift Cards
≤4.38.0Update to 4.38.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
MDJM Event Management
≤1.7.8.7No patch available
- Medium5.3Missing Authorization
MDJM Event Management
≤1.7.8.7No patch available
- High8.8Authenticated (Subscriber+) Insecure Direct Object Reference to Account Takeover
MDJM Event Management
≤1.7.8.7No patch available
- Medium5.32.1.0 - Missing Authorization
Subscriptions for WooCommerce
2.0.0 – 2.1.0Update to 2.1.1
- Medium5.3Missing Authorization
Community Events
≤1.5.0Update to 1.6.0
- Medium5.33.4.1 - Unauthenticated Insecure Direct Object Reference
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
3.4.0 – 3.4.1Update to 3.4.2
- Medium4.34.1.3 - Authenticated (Subscriber+) Information Exposure
Tutor LMS – eLearning and online course solution
1.6.4 – 4.1.3Update to 4.2.0
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
FV Flowplayer Video Player
≤7.5.56.7211Update to 7.5.56.7212
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.5.56.7211Update to 7.5.56.7212
- Medium4.3Missing Authorization
FV Flowplayer Video Player
≤7.5.56.7211Update to 7.5.56.7212
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint
BuddyBoss App
≤3.2.1Update to 3.2.2
- High7.3Unauthenticated Privilege Escalation
Uncanny Toolkit for LearnDash
≤3.8.2Update to 3.8.3
- High7.5Unauthenticated Denial of Service
SAML Single Sign On – SSO Login
≤6.1.0Update to 6.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.26Update to 2.0.27
- Medium5.3Missing Authorization
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.8.2Update to 3.8.3
- Medium5.3Unauthenticated CAPTCHA Protection Bypass
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.1Update to 1.44.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Customer Area
≤8.4.1Update to 8.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Booking System – Booking Calendar
≤2.1.0.6Update to 2.1.0.7
- Medium5.3Unauthenticated Information Exposure
DOOFINDER Search and Discovery for WP & WooCommerce
≤2.17.2Update to 2.17.3
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Customer Area
≤8.4.1Update to 8.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤2.0.3Update to 2.0.3.1
- High8.12.4.1 - Unauthenticated Privilege Escalation via OTP Brute Force
All In One Login
2.4.0 – 2.4.1Update to 2.5.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
≤3.4.1Update to 3.4.2