Database
Critical WordPress vulnerabilities (page 34)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
Contact Manager
≤9.1.2Update to 9.1.3
- Medium6.1Reflected Cross-Site Scripting via 'l10n_print_after' Parameter
Webheadcoder Multi-Step Forms for Contact Form 7
≤4.7Update to 4.7.1
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
CMB2
≤2.13.4Update to 2.13.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.7.2Update to 4.7.3
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.4.1Update to 6.4.2
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink
Postie
≤1.9.87Update to 1.9.88
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.2Update to 1.10.3
- High8.8Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action
AI ChatBot for WooCommerce – WoowBot
≤5.0.0Update to 5.0.1
- High8.8Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload
The Innovative Form Builder – IvyForms
≤1.5.1Update to 1.5.2
- Medium6.5Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute
WP Inventory Manager
≤2.5.5Update to 2.5.6
- Medium6.3Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation
BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility
≤1.3.6Update to 1.3.7
- Medium5.3Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action
PayPal Brasil para WooCommerce
≤1.7.8Update to 1.7.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute
VikRentCar Car Rental Management System
≤1.4.10Update to 1.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.3Update to 7.8.14.4
- Medium6.5Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute
VikRentCar Car Rental Management System
≤1.4.10Update to 1.4.11
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter
Related Posts for WordPress
≤3.0.0Update to 3.0.1
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.3Update to 7.8.14.4
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
Related Posts for WordPress
≤3.0.0Update to 3.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
Avada (Fusion) Builder
≤3.16.2Update to 3.16.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.27Update to 2.2.28
- Medium5.9Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More
≤1.31.0Update to 1.32.0
- Medium6.5Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute
WP Visitor Statistics (Real Time Traffic)
≤8.8Update to 8.9
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter
Product Addons for Woocommerce – Product Options with Custom Fields
≤3.1.8Update to 3.1.9
- Medium6.5Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
Rich Showcase for Google Reviews
≤7.1.6Update to 7.1.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
Waitlist Woocommerce ( Back in stock notifier )
≤2.9.1Update to 2.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.6Update to 2.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL
UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks
≤5.3.0Update to 5.4.0
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.6Update to 2.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤261011Update to 261017