Database
Critical WordPress vulnerabilities (page 46)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.32.12.2 - Missing Authorization
MB Custom Post Types & Custom Taxonomies
2.4.0 – 2.12.2Update to 2.12.3
- Medium5.32.12.2 - Missing Authorization
MB Custom Post Types & Custom Taxonomies
2.0.2 – 2.12.2Update to 2.12.3
- High7.2Unauthenticated Stored Cross-Site Scripting
PixelYourSite Pro – Your smart PIXEL (TAG) Manager
<12.6.8Update to 12.6.8
- Medium5.3Missing Authorization
Infility Global
≤2.16.24Update to 2.16.25
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
WP Ultimate Review
≤2.4.4Update to 2.4.5
- Medium5.3Unauthenticated Insecure Direct Object Reference
FluentCart – Online Store Builder & eCommerce Checkout
≤2.1.0Update to 2.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
DiviGear Carousel
≤5.2.0Update to 5.2.2
- High7.5Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
EventON - Subscriber
≤1.4.5No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Mang Board
≤2.4.4Update to 2.4.5
- Medium5.3Missing Authorization
BjornTech Swish for WooCommerce
≤3.7.8Update to 3.7.9
- Medium6.1Reflected Cross-Site Scripting
Geo Mashup
≤1.13.22Update to 1.13.23
- High7.2Unauthenticated Stored Cross-Site Scripting
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.5Update to 4.9.6
- Medium4.3Missing Authorization
Surfer – WordPress Plugin
≤1.8.0.744Update to 1.8.1.759
- High7.5Authenticated (Contributor+) Local File Inclusion
WP Mailster
≤1.9.1.0Update to 1.9.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤34.0.1Update to 34.0.2
- Medium6.1Reflected Cross-Site Scripting
ThemeHunk Customizer
≤2.8.7Update to 2.8.8
- Medium6.1Reflected Cross-Site Scripting
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.14Update to 7.5.15
- High7.5Unauthenticated SQL Injection
Ajax Search Lite – Live Search & Filter
≤4.14.6Update to 4.14.7
- Medium5.3Missing Authorization
YITH WooCommerce Product Bundles
≤2.29.0Update to 2.30.0
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Tickets and Registration
≤5.30.1Update to 5.30.2
- Medium5.3Missing Authorization
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.15Update to 6.2.16
- Medium4.3Missing Authorization
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses
≤2.11.0Update to 2.12.0
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.10Update to 4.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.4Update to 2.9.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
E2Pdf – Export Pdf Tool for WordPress
≤1.32.57Update to 1.32.58
- Medium5.3Missing Authorization
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.5Update to 2.3.6
- Medium5.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.7Update to 7.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YITH WooCommerce Wishlist
≤4.18.1Update to 4.19.0
- High7.5Authenticated (Contributor+) PHP Object Injection
Team Members – Team Showcase, Team Slider, Grid, Table & Staff Directory
≤2.8.2Update to 2.8.3