Database
Critical WordPress vulnerabilities (page 47)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Contributor+) PHP Object Injection
GS Pinterest Portfolio – Pinterest Feed, Pinterest Board & Pin Widgets
≤1.9.2Update to 1.9.3
- Medium6.1Reflected Cross-Site Scripting
Live Summary for Gravity Forms
≤1.2.10Update to 1.2.11
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.5Update to 3.15.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Strong Testimonials
≤3.3.12Update to 3.3.13
- Medium5.3Unauthenticated Information Exposure
WholesaleX – Wholesale Pricing & B2B Solution
≤3.0.8Update to 3.0.9
- Medium4.3Missing Authorization
Sensei LMS – Online Courses, Quizzes, & Learning
≤4.26.3Update to 4.26.4
- High8.8Authenticated (Subscriber+) Arbitrary PHP Code Execution
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.5Update to 6.2.0
- Medium5.3Unauthenticated Abandoned Cart Takeover
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails
<2.2.0Update to 2.2.0
- Medium6.5Authenticated (Subscriber+) SQL Injection via mec_fes_csv_export
Modern Events Calendar
<7.37.0Update to 7.37.0
- Medium5.30.3.9 - Missing Authorization
Wava Payment Plugin
0.3.1 – 0.3.9Update to 0.3.10
- High7.2Unauthenticated Stored Cross-Site Scripting
Jane Menu
≤1.5.0Update to 1.5.1
- Medium5.8Unauthenticated HTML Injection
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
<1.26.15Update to 1.26.15
- Medium4.3Missing Authorization
Sensei LMS – Online Courses, Quizzes, & Learning
≤4.26.3Update to 4.26.4
- Medium5.3Missing Authorization
SUMIT Payment Gateway for WooCommerce
<4.0.0Update to 4.0.0
- Medium5.3Unauthenticated Account Activation Bypass
WholesaleX – Wholesale Pricing & B2B Solution
<3.0.9Update to 3.0.9
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤4.0.0Update to 4.0.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Kliken: Ads + Pixel for Meta
≤1.2.2Update to 1.2.3
- Medium5.3Unauthenticated Information Exposure
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.9.4Update to 4.9.5
- Medium5.3Unauthenticated Insecure Direct Object Reference
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- Medium4.3Missing Authorization
Backup and Staging by WP Time Capsule
≤1.22.27Update to 1.22.28
- Low2.7Missing Authorization
Uncanny Toolkit for LearnDash
≤3.8.1Update to 3.8.2
- High8.8Cross-Site Request Forgery
Uncanny Toolkit for LearnDash
<3.8.2Update to 3.8.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Modern Events Calendar
<7.37.0Update to 7.37.0
- Medium5.3Unauthenticated Payment Forgery
Snap Finance
<3.12.0Update to 3.12.0
- Medium5.31.1.2 - Unauthenticated Information Exposure
Click n Chat (Chat Widget Integration)
1.0.4 – 1.1.2Update to 1.1.3
- High7.51.1.2 - Unauthenticated SQL Injection
Click n Chat (Chat Widget Integration)
1.0.4 – 1.1.2Update to 1.1.3
- High7.5Unauthenticated SQL Injection
Click n Chat (Chat Widget Integration)
≤1.1.2Update to 1.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Translate WordPress with Weglot 2.0 – Multilingual AI Translation
≤6.4.2Update to 6.4.3
- Medium5.30.3.9 - Missing Authorization
Wava Payment Plugin
0.3.1 – 0.3.9Update to 0.3.10
- Medium4.3Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery
Download Manager
≤7.5.8Update to 3.3.71 or 7.5.9