Database
Critical WordPress vulnerabilities (page 55)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
Mang Board
≤2.4.4Update to 2.4.5
- High7.2Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX
Mang Board
≤2.4.3Update to 2.4.4
- Critical9.8Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
≤1.2.78.6Update to 1.2.78.7
- Critical9.82.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
Mang Board
2.4.4 – 2.4.4Update to 2.4.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.1Update to 1.58.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via parser_callback
Broken Link Checker
≤2.4.14.1Update to 2.4.15
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow
Bulk Page Generator – LPagery
≤3.1.0Update to 3.1.1
- Medium6.5Authenticated (Custom+) SQL Injection via 'filters' Parameter
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance
≤1.31.4Update to 1.31.5
- High7.5Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
InstaWP Connect – 1-click WP Staging & Migration
≤0.1.4.1Update to 0.1.4.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
Klarna for WooCommerce
≤4.13.3Update to 4.13.4
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy
≤1.2.0Update to 1.3.0
- High8.1Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.9.3Update to 4.9.4
- Medium6.1Reflected Cross-Site Scripting via 'permalink' Parameter
Gwolle Guestbook
≤5.1.1Update to 5.1.2
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
≤3.16.0.6Update to 3.17.0
- High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.0Update to 1.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
≤1.2.4Update to 1.2.5
- Medium4.9Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
FluentCart – Online Store Builder & eCommerce Checkout
≤1.7.0Update to 1.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤5.2.11Update to 5.2.12
- High8.1Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
Customer Email Verification for WooCommerce
≤3.3.0Update to 3.3.1
- Medium4.3Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤5.2.1Update to 5.3.0
- Medium5.9Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>
Debloat – Remove Unused CSS, Optimize JS
≤1.3.0Update to 1.4.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter
Complianz GDPR/CCPA Cookie Consent Banner
≤7.5.5Update to 7.5.6
- High7.2Unauthenticated Stored Cross-Site Scripting via Comments
Colibri Page Builder
≤1.0.390Update to 1.0.392
- High8.0Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
Backuply – Backup, Restore, Migrate and Clone
≤1.5.8Update to 1.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute
Dark Mode – Improve Accessibility with AI Powered Dark Theme
≤5.3.17Update to 5.3.18
- Medium4.86.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
6.4.1 – 6.4.2Update to 6.4.3
- Medium5.3Unauthenticated Information Exposure
Gantry 5 Framework
≤5.6.4Update to 5.6.5
- Medium6.1Reflected Cross-Site Scripting
Fancy Comments WordPress
≤1.2.21No patch available
- Medium4.3Missing Authorization
Squeeze – Browser-Based Image Compression & WebP Converter (No API, No Limits)
≤1.8.0Update to 1.8.1