Database
Critical WordPress vulnerabilities (page 35)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.2.4Update to 4.2.5
- Medium4.9Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment
Tainacan
≤1.3.0Update to 1.4.0
- High7.2Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.7.8Update to 5.7.9
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating
MxChat – AI Chatbot & Content Generation for WordPress
≤3.2.25Update to 3.2.26
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
Mang Board
≤2.4.5Update to 2.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.2Update to 1.10.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.2Update to 1.10.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
≤2.8.2Update to 2.8.3
- Medium4.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute
DesignSetGo
≤2.11.0Update to 2.11.1
- Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute
Document Embedder – let visitors read files without downloading
≤2.4.0Update to 2.4.1
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook
Clean Login
≤1.20.1Update to 1.21
- Medium4.8Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter
Customer Email Verification for WooCommerce – OTP Verification, Block Fake Signups
≤2.8.2Update to 2.8.3
- High7.5Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload
Product Designer for WooCommerce WordPress | Lumise
≤2.1.2No patch available
- Medium4.3Cross-Site Request Forgery
Newsletters
≤4.18.2No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter
Appointment Booking Calendar
≤1.4.05Update to 1.4.06
- High7.5Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.2Update to 3.9.3
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute
Animated Text Block – Add Typing and Looping Text Effects
≤1.2.6Update to 1.2.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.7Update to 5.0.0
- Medium4.2Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.4Update to 3.8.5
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter
AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot
≤1.2.8Update to 1.2.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.7Update to 5.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
AMP for WP – Accelerated Mobile Pages
≤1.1.17Update to 1.1.18
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter
AI Alt Text Generator
≤2.7.0Update to 2.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.2Update to 3.9.3
- Critical9.8Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
Pie Register Premium
≤3.8.4.0Update to 3.8.4.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.14.0Update to 2.14.1
- Critical9.8Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
Jupiter X Core
≤4.61.0Update to 4.62.0
- Medium6.1Reflected Cross-Site Scripting
TableOn – WordPress Posts Table Filterable
≤1.0.7Update to 1.0.8
- High7.5Unauthenticated SQL Injection
Motors – Car Dealership & Classified Listings Plugin
≤1.4.126Update to 1.4.127
- Medium6.1Reflected Cross-Site Scripting
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.
≤3.1.7No patch available