Database
Critical WordPress vulnerabilities (page 48)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.4Update to 4.3.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.4Update to 4.3.5
- Medium5.3Missing Authorization
TI WooCommerce Wishlist
≤2.12.0Update to 2.13.0
- High7.32.9.25 - Unauthenticated Privilege Escalation
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
2.9.21 – 2.9.25Update to 2.9.26
- Medium4.36.3.0 - Two-Factor Authentication Bypass
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
6.2.9 – 6.3.0Update to 6.3.1
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Pricing Table WordPress Plugin – Easy Pricing Tables
≤4.1.2Update to 4.1.3
- Critical9.1Unauthenticated Arbitrary File Deletion
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.28Update to 1.6.29
- High7.23.2.11 - Unauthenticated Stored Cross-Site Scripting
Redirection for Contact Form 7
2.2.7 – 3.2.11Update to 3.2.12
- Low2.7Missing Authorization
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
≤3.8.5Update to 3.8.6
- Medium6.5Authenticated (Author+) SQL Injection
Swift Performance Lite
≤2.3.7.3Update to 2.3.7.4
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
WPZOOM Portfolio Lite – Filterable Portfolio Plugin
≤1.4.33Update to 1.4.34
- Medium5.3Unauthenticated Payment Bypass
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium4.3Missing Authorization
Productive Commerce – Wishlist, Compare & MiniCart
≤1.1.48Update to 1.1.49
- Medium6.1Reflected Cross-Site Scripting
WP Booking System – Booking Calendar
≤2.1.0.2Update to 2.1.0.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
HireZoot – Job Listings, Career Page & Recruitment Tool
≤4.1.0Update to 4.1.1
- Medium4.3Missing Authorization
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.3Update to 1.23.4
- Medium4.3Missing Authorization
Moloni
≤5.0.13Update to 5.0.14
- Medium5.3Unauthenticated Information Exposure
Booking Package
≤1.7.30Update to 1.7.31
- Medium5.3Missing Authorization
Booking Package
≤1.7.30Update to 1.7.31
- Medium5.3Missing Authorization
Escape Room Booking Pro
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Falang multilanguage for WordPress
≤1.4.5Update to 1.4.6
- Medium4.3Authenticated (Agent+) Insecure Direct Object Reference
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.7.4Update to 5.7.5
- Medium4.35.3.2 - Authenticated (Contributor+) Payment Bypass
Simple Shopping Cart
5.1.3 – 5.3.2Update to 5.3.3
- Medium5.3Unauthenticated Payment Bypass
Simple Shopping Cart
≤5.3.2Update to 5.3.3
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Payment Gateway for Idram
<2.1.6Update to 2.1.6
- Medium5.31.1.1 - Missing Authorization
Synchrony Financing
1.0.5 – 1.1.1Update to 1.1.2
- High8.8Authenticated (Contributor+) Remote Code Execution
HivePress – Business Directory, Listings & Classified Ads Plugin
≤1.7.32Update to 1.8.0
- Medium6.3Authenticated (Author+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤6.8.5Update to 6.8.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤4.1.2Update to 4.1.3
- High7.5Authenticated (Contributor+) PHP Object Injection
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8