Database
Critical WordPress vulnerabilities (page 42)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.1Update to 1.2.2
- Medium5.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤3.7.5Update to 3.8
- High8.1Unauthenticated PHP Object Injection
Paytium: Mollie payment forms & donations
≤5.0.5Update to 5.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
VOD Infomaniak
≤1.5.14Update to 1.5.15
- Medium6.1Reflected Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.8Update to 7.4.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤4.9.7Update to 5.0.0
- Medium4.3Missing Authorization
SureDash – Community, Courses & Member Dashboard
≤1.12.2Update to 1.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
QA Assistants – Driven by data
≤5.3.0.1Update to 5.3.0.2
- High7.2Unauthenticated Stored Cross-Site Scripting
W3 Total Cache
≤2.10.7Update to 2.11.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Off-Canvas Sidebars & Menus (Slidebars)
≤0.5.9Update to 0.5.9.1
- Medium5.3Missing Authorization
SureDash – Community, Courses & Member Dashboard
≤1.12.2Update to 1.12.3
- Medium5.3Missing Authorization
SureDash – Community, Courses & Member Dashboard
≤1.12.2Update to 1.12.3
- Medium5.3Unauthenticated Information Exposure
LiteSpeed Cache
≤7.9Update to 7.9.1
- High7.5Unauthenticated SQL Injection
Product Filter for WooCommerce by WBW
≤3.4.6Update to 3.4.7
- High8.1Unauthenticated PHP Object Injection
Newsletters
≤4.18.1Update to 4.18.2
- Medium6.1Reflected Cross-Site Scripting
We’re Open!
≤2.6Update to 2.7
- High7.5Unauthenticated SQL Injection
Newsletters
≤4.18.1Update to 4.18.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.26Update to 4.1.27
- Medium4.3Missing Authorization
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤3.1.0Update to 3.1.1
- Medium4.3Missing Authorization
Strong Testimonials
≤3.3.14Update to 3.3.15
- Medium5.3Missing Authorization
Falcon – Cache, Performance, Security, Cleanup, and Tweaks
≤2.12.0Update to 2.12.1
- Medium5.3Missing Authorization
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.2Update to 4.3.3
- Medium4.3Missing Authorization
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
≤2.1.72Update to 2.1.80
- Medium4.3Cross-Site Request Forgery
Xpro Addons — 150+ Widgets for Elementor
≤1.7.10Update to 1.7.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Interactive Content – H5P
≤1.17.9Update to 1.17.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.14.4Update to 1.14.5
- Medium6.49.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
8.5.49 – 9.0.2Update to 9.0.3
- Medium5.3Missing Authorization
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Zoom API Credential Modification
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2
- High7.2Authenticated (Administrator+) Remote Code Execution
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194