Database
Critical WordPress vulnerabilities (page 38)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Unlimited Elements for Elementor
≤2.0.24Update to 2.0.25
- High7.5Unauthenticated SQL Injection
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤3.8.5.2Update to 3.8.6
- Medium6.1Reflected Cross-Site Scripting
eCommerce Product Catalog
≤3.6.4Update to 3.6.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Discussion Board – WordPress Forum Plugin
≤2.6.0Update to 2.6.1
- High7.5Unauthenticated SQL Injection
DXP ToolKit
≤2.0.1Update to 2.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
DXP ToolKit
≤2.0.1Update to 2.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.62Update to 2.8.63
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetSmartFilters
≤3.8.6.1Update to 3.8.6.2
- Medium4.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.5Update to 4.7.6
- Medium5.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.7.5Update to 4.7.6
- Medium5.3Missing Authorization
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.10.7Update to 1.11.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Panorama – Turn Photos into Immersive Virtual Tours
≤1.8.3Update to 1.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
bSlider – Build Sliders That Bring Your Content to Life
≤2.2.2Update to 2.2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.5Update to 2.9.2.6
- Medium4.3Authenticated (Contributor+) Information Exposure
Media Library Assistant
≤3.42Update to 3.43
- Medium4.3Missing Authorization
Geo Mashup
≤1.13.22Update to 1.13.23
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Geo Mashup
≤1.13.22Update to 1.13.23
- Medium6.5Authenticated (Contributor+) SQL Injection
JetEngine
≤3.9.0Update to 3.9.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Lazy Load for Videos
≤2.18.11Update to 2.18.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Better Post & Filter Widgets for Elementor
≤1.9.1Update to 1.9.2
- Medium6.5Authenticated (Author+) SQL Injection
Media Library Assistant
≤3.42Update to 3.43
- Medium4.3Missing Authorization
Better Post & Filter Widgets for Elementor
≤1.9.1Update to 1.9.2
- Medium6.1Reflected Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium5.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.8.2Update to 2.8.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1069Update to 1.7.1070
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1069Update to 1.7.1070
- Medium4.3Cross-Site Request Forgery
Media Library Assistant
≤3.42Update to 3.43
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.7.1069Update to 1.7.1070
- Medium5.3Missing Authorization
Bopo – WooCommerce Product Bundle Builder
≤1.2.3Update to 1.2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.8.0.1Update to 3.8.0.2