Database
Critical WordPress vulnerabilities (page 30)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
YITH PayPal Express Checkout for WooCommerce
≤1.62.0Update to 1.62.1
- Medium5.3Missing Authorization
Payable Payment Gateway for WooCommerce
≤1.3.0Update to 1.3.1
- Medium5.39.18 - Unauthenticated Information Exposure
Quick Event Manager
8.4.6 – 9.18Update to 9.19
- Medium4.3Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium4.3Authenticated (Custom+) Path Traversal
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.7.49Update to 3.7.50
- Medium5.3Unauthenticated Arbitrary Content Injection
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
≤0.8.8Update to 0.8.9
- Low3.5Authenticated (Subscriber+) Arbitrary Page Content Injection
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.4.0Update to 6.4.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.0Update to 5.3.1
- Medium5.3Missing Authorization to Unauthenticated Information Exposure
Bricks Theme
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
<4.2.5No patch available
- Medium6.42.6.8 - Authenticated (Shop Manager+) Server-Side Request Forgery
Product Import Export for WooCommerce – CSV Product Importer & Exporter
2.5.1 – <2.6.8Update to 2.6.8
- Medium5.3Missing Authorization
Mapster WP Maps
≤2.0.5Update to 2.0.6
- Medium5.3Unauthenticated Information Exposure
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.0.0Update to 5.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Firelight Lightbox
≤2.3.23Update to 2.3.24
- Medium5.32.10.0 - Unauthenticated Arbitrary Guest Attachment Deletion
BuddyForms
2.8.8 – 2.10.0Update to 2.10.1
- Medium4.3Two-Factor Authentication via Brute Force
Security Optimizer – The All-In-One Protection Plugin
≤1.6.8Update to 1.6.9
- Medium5.3Missing Authorization
Premium Packages – Sell Digital Products Securely
≤7.2.1Update to 7.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.42Update to 3.43
- Medium6.5Authenticated (Author+) Path Traversal
Bulk Media Register
≤2.0Update to 2.01
- Medium4.7SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 -Unauthenticated Arbitrary HTML Injection
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
≤2.12.9Update to 2.13.0
- High7.25.16.4 - Unauthenticated Stored Cross-Site Scripting
PDF Invoices & Packing Slips For WooCommerce
5.16.2 – 5.16.4Update to 5.16.5
- Medium6.36.8.7 - Authenticated (Author+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
6.6.0 – 6.8.7Update to 6.8.8
- Medium4.3Authenticated (Contributor+) Information Exposure
Payment Forms for Paystack
≤4.0.5Update to 4.0.6
- Medium5.32.4.5 - Unauthenticated Payment Bypass
PayHere Payment Gateway
2.4.0 – 2.4.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters
NewsmanApp
≤3.7.29Update to 3.7.32
- Medium5.3Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
MW WP Form
≤5.1.7Update to 5.1.8
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
Meta Box – A Framework for Dynamic Websites
≤5.15.2Update to 5.15.3
- High7.5Unauthenticated SQL Injection via 'slug' Parameter
Newsmatic
≤1.5.0Update to 1.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Content-Type Header
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.3.2Update to 9.3.3
- Medium4.7Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
Media Library Assistant
≤3.42Update to 3.43