Database
Critical WordPress vulnerabilities (page 39)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Gallery Block – Showcase Photos in Stunning Responsive Grids
≤2.4.1Update to 2.4.2
- Medium5.3Missing Authorization
Discussion Board – WordPress Forum Plugin
≤2.6.0Update to 2.6.1
- Medium4.3Cross-Site Request Forgery
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤3.8.5.2Update to 3.8.6
- Medium4.3Missing Authorization
DEPART – Deposit and Part payment for Woo
≤1.0.10Update to 1.1.0
- Medium4.3Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.6Update to 3.8.7
- Medium5.3Missing Authorization
Link Library
≤7.9.0Update to 7.10.0
- High7.5Unauthenticated SQL Injection
vTables – Data Table Builder for CSV, Excel & JSON
≤0.2Update to 0.3
- Medium5.35.45 - Unauthenticated Payment Bypass
PAYCOMET for WooCommerce
5.36 – 5.45Update to 5.46
- Medium5.3Unauthenticated Information Exposure
Link Library
≤7.9.0Update to 7.10.0
- Medium5.3Unauthenticated Discount Code Limit Bypass
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.1Update to 3.7.2
- Medium4.7Unauthenticated HTML Injection
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.7.9Update to 5.7.10
- Medium5.4Authenticated (Contributor+) Cross-Site Scripting
Advanced Post Block – Display Your Posts Exactly How You Want
≤2.5.1Update to 2.5.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Advanced Ads – Tracking
<4.0.0Update to 4.0.0
- Medium5.3Unauthenticated Arbitrary Email Header Injection
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium5.3Missing Authorization
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- High7.2Authenticated (Administrator+) Remote Code Execution
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium4.3Cross-Site Request Forgery
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium4.3Cross-Site Request Forgery
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.11.0Update to 1.11.1
- Medium5.33.6.3 - Unauthenticated Information Exposure
Recipe Card Blocks Lite
2.6.4 – 3.6.3Update to 3.6.4
- Medium5.3Missing Authorization to Unauthenticated Roster Member Deletion
WP Roster
<2.35Update to 2.35
- Medium4.3Cross-Site Request Forgery
Media Library Assistant
<3.42Update to 3.42
- Medium4.7Unauthenticated Open Redirect
Welcart e-Commerce
<2.12.6Update to 2.12.6
- Medium5.3Unauthenticated Login URL Settings Modification
WPOrLogin – Custom Login, Social Login, CAPTCHA & Security
<3.1.0Update to 3.1.0
- High7.36.8.6 - Unauthenticated Registration Approval Bypass
Essential Addons for Elementor – Popular Elementor Templates & Widgets
6.7.3 – 6.8.6Update to 6.8.7
- Medium5.3Unauthenticated Unauthorized Email Relay
Royal Addons for Elementor – Addons and Templates Kit for Elementor
<1.7.1070Update to 1.7.1070
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng
<4.2.0Update to 4.2.0
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
UniPAY Payment Gateway For WooCommerce
≤2.3Update to 2.4
- Medium5.3Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Confirmation
Sadad QA Payment
≤1.28Update to 1.29
- Medium5.3Unauthenticated Payment Bypass
BitPay Gateway for WooCommerce
≤4.1.3No patch available
- Medium5.31.2.1 - Unauthenticated Order Payment Forgery
TiendaCrypto para WooCommerce
1.0.1 – 1.2.1No patch available