Database
Critical WordPress vulnerabilities (page 43)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Chikkili- Google Pay India for Woocommerce
≤1.0.6No patch available
- Medium4.33.7.54 - Missing Authorization
MasterStudy LMS WordPress Plugin – for Online Courses and Education
3.7.13 – 3.7.54Update to 3.7.55
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<4.0.0Update to 4.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium5.3Unauthenticated Information Exposure
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium6.5Authenticated (Subscriber+) Arbitrary Media File Read
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium5.3Unauthenticated Information Exposure
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.8.193Update to 2.8.194
- Medium6.1Reflected Cross-Site Scripting
Download Monitor
≤5.3.3Update to 5.3.4
- Medium4.7Authenticated (Admin+) Arbitrary File Write
JetBackup – Backup, Restore & Migrate
≤3.1.24.9Update to 3.1.24.10
- Medium5.3Two-Factor Authentication Bypass
asVereinbase – Club & Member Management for WP
≤1.1.7Update to 1.1.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels
≤2.2.2Update to 2.2.3
- Critical9.85.0.52 - Unauthenticated Arbitrary File Upload
YOOtheme Pro
5.0.0 – 5.0.52Update to 5.0.53
- Medium4.3Cross-Site Request Forgery
Tailored Tools
≤3.0.3Update to 3.0.5
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Interactive Content – H5P
≤1.17.9Update to 1.17.10
- Medium4.3Missing Authorization
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.7.1Update to 1.7.2
- High8.1Unauthenticated PHP Object Injection
Save Life | Non-Profit, Charity & Donations WordPress Theme
≤1.2.14No patch available
- Medium6.50.9.2.7 - Unauthenticated Arbitrary Shortcode Execution
Advanced Custom Fields: Extended
0.9.2.4 – 0.9.2.7Update to 0.9.2.8
- Medium5.3Missing Authorization
Front End Users
≤3.2.35No patch available
- Medium4.3Missing Authorization
News Kit Addons For Elementor
≤1.4.8Update to 1.4.9
- High7.5Unauthenticated Denial of Service
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<7.0Update to 7.0
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
<6.0.0Update to 6.0.0
- High8.1Unauthenticated PHP Object Injection
Participants Database
≤2.7.8.5No patch available
- High7.5Unauthenticated SQL Injection
Participants Database
≤2.7.8.5No patch available
- High8.1Jewelry & Watch Store Shopify Theme <= 1.0.8 - Unauthenticated PHP Object Injection
Reprizo - Jewelry & Watch Store Shopify Theme
≤1.0.8No patch available
- High8.1Travel Blog Elementor Template Kit <= 1.3.10 - Unauthenticated PHP Object Injection
Vagabonds - Travel Blog Elementor Template Kit
≤1.3.10No patch available
- High8.1Unauthenticated PHP Object Injection
redy
≤1.3.5No patch available
- High8.1Unauthenticated PHP Object Injection
Holistic Center | Wellness & Spa Salon PSD Template
≤1.2.6No patch available
- High8.1Unauthenticated PHP Object Injection
Helion | Personal Portfolio & Agency WordPress Theme
≤1.1.12No patch available