Database
Critical WordPress vulnerabilities (page 24)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Contributor+) Local File Inclusion
Unlimited Elements for Elementor
≤2.0.26Update to 2.0.27
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
W3 Total Cache
≤2.10.7Update to 2.11.0
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.31Update to 1.0.32
- High7.2Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter
VikRentCar Car Rental Management System
≤1.4.10Update to 1.4.11
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
W3 Total Cache
≤2.10.7Update to 2.11.0
- Medium6.5Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
≤1.2.78Update to 1.2.79
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20260916Update to 20261029
- High7.2Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter
VikRentCar Car Rental Management System
≤1.4.9Update to 1.4.10
- Medium5.3Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
Welcart e-Commerce
≤2.12.5Update to 2.12.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
Welcart e-Commerce
≤2.12.5Update to 2.12.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.12.1Update to 3.12.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium5.3Unauthenticated Sensitive Information Exposure in Object Cache Directory
Seraphinite Accelerator
≤2.29.24Update to 2.29.25
- High7.2Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter
Shipping Zones by Drawing for WooCommerce
≤3.3.0Update to 3.3.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
Relevanssi – A Better Search
≤4.28.5Update to 4.28.6
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤4.4.5Update to 4.4.6
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
PDF Invoice for WooCommerce + Drag and Drop Template Builder
≤7.1.1Update to 7.2.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- High7.2Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision
PPWP – Password Protect Pages
≤1.9.26Update to 1.9.27
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- High7.2Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- Medium5.4Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.5.4Update to 4.5.5
- High7.2Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
Meow Lightbox
≤5.6.4Update to 5.6.5
- High7.5Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤4.4.1Update to 4.5.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
Meow Gallery
≤5.5.1Update to 5.5.2
- Medium4.7Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header
Like Button Rating ♥ LikeBtn
≤2.6.64Update to 2.6.65
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'columns' Parameter
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.2Update to 1.2.3
- Medium5.4Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
FV Flowplayer Video Player
≤7.5.55.7212Update to 7.5.56.7212
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.199Update to 2.8.200
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
FV Flowplayer Video Player
≤7.5.55.7212Update to 7.5.56.7212