Database
Critical WordPress vulnerabilities (page 41)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
CCAvenue Payment Gateway for WooCommerce
≤3.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.0Update to 1.8.0
- Medium4.39.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
9.0.0 – 9.0.2Update to 9.0.3
- Low2.7Missing Authorization
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<4.0.5Update to 4.0.5
- Medium6.4Authenticated (Give Worker+) Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.0Update to 4.19.0.1
- Medium6.5Authenticated (Give Manager+) Path Traversal
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.0Update to 4.19.0.1
- Medium5.3Unauthenticated Information Exposure
GiveWP – Donation Plugin and Fundraising Platform
≤4.19.0.0Update to 4.19.0.1
- Low2.7Missing Authorization
Speed Optimizer – The All-In-One Performance-Boosting Plugin
<7.8.5Update to 7.8.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Speed Optimizer – The All-In-One Performance-Boosting Plugin
<7.8.5Update to 7.8.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<6.8.7Update to 6.8.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
<3.2.8Update to 3.2.8
- Medium5.3Missing Authorization
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
<3.2.8Update to 3.2.8
- Medium5.33.2.7 - Missing Authorization
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
3.1.1 – 3.2.7Update to 3.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
<3.2.8Update to 3.2.8
- Medium5.3Unauthenticated Payment Bypass
Online Payments with iK Pay Gateway
≤3.0.3Update to 3.0.4
- Medium5.3Unauthenticated Order Payment Forgery
Eurobank WooCommerce Payment Gateway
<2.1.2Update to 2.1.2
- Critical9.8Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
Prime Mover – Backup and Migration
≤2.2.1Update to 2.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter
Anti-Spam, Spam FireWall by CleanTalk
≤6.89.1Update to 6.90
- Medium5.3Missing Authorization
UPI QR Code Payment Gateway for WooCommerce
≤1.6.3Update to 1.7.0
- Medium6.6Authenticated (Editor+) PHP Object Injection
Relevanssi – A Better Search
≤4.28.4Update to 4.28.5
- Medium5.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤5.7.8Update to 5.7.9
- Medium5.3Missing Authorization
Social Feed Gallery
≤5.0.13No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Extensions for Leaflet Map
≤6.0Update to 6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ND Shortcodes
≤7.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Waitlist Woocommerce ( Back in stock notifier )
≤2.9.1Update to 2.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Restaurant Menu – Food Ordering System – Table Reservation
≤2.4.4No patch available
- Medium5.3Missing Authorization
ЮKassa для WooCommerce
≤2.17.3Update to 2.17.4
- Medium5.3Unauthenticated Information Exposure
ShopMagic – email automation for WordPress
≤4.9.1Update to 4.9.2
- Medium6.1Reflected Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium5.3Missing Authorization
Page and Post Restriction
≤1.6.0Update to 1.6.1