Database
Critical WordPress vulnerabilities (page 57)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
AWP Classifieds
<4.4.9Update to 4.4.9
- High8.1Unauthenticated PHP Object Injection
Gravity Forms
<3.1.1Update to 3.1.1
- Medium6.1Reflected Cross-Site Scripting
Houzez
≤4.4.0Update to 4.4.1
- Medium5.32.5.2 - Missing Authorization
Sifalo Pay
2.0 – 2.5.2Update to 2.5.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
rtMedia for WordPress, BuddyPress and bbPress
<4.7.14Update to 4.7.14
- Medium4.7Unauthenticated Open Redirect
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium4.3Missing Authorization
YITH WooCommerce Popup
<1.60.0Update to 1.60.0
- Medium5.3Unauthenticated Arbitrary Order Payment Confirmation
Tickera – Sell Tickets & Manage Events
<3.6.0.4Update to 3.6.0.4
- Medium5.3Unauthenticated Arbitrary Order Status Manipulation
Asaas Gateway for WooCommerce
<2.7.8Update to 2.7.8
- Medium5.4Unauthenticated Limited Privilege Escalation via 'process_registration'
WholesaleX – Wholesale Pricing & B2B Solution
≤3.0.8Update to 3.0.9
- Medium5.3Unauthenticated Information Exposure
bbPress
<2.6.19No patch available
- Medium5.3Missing Authorization
Restricted Site Access
≤7.6.2Update to 7.6.3
- Medium4.3Authenticated (Contributor+) Information Exposure
Product Delivery Date for WooCommerce – Lite
≤3.3.1Update to 3.3.2
- Medium4.3Missing Authorization
MB Custom Post Types & Custom Taxonomies
≤2.12.1Update to 2.12.2
- Medium6.5Insufficient Authorization to Booking API Access
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium4.3Missing Authorization
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
<8.0.6Update to 8.0.6
- Medium5.3Unauthenticated Information Exposure
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
<5.5.84Update to 5.5.84
- Medium5.3Missing Authorization
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
<5.5.77Update to 5.5.77
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
<3.6.15Update to 3.6.15
- Medium5.3Unauthenticated Insecure Direct Object Reference
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails
<2.1.4Update to 2.1.4
- Medium5.3Missing Authorization
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster
<2.8.0Update to 2.8.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.0Update to 1.10.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
Tainacan
<1.4.0Update to 1.4.0
- Medium5.3Missing Authorization
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
<5.3.2Update to 5.3.2
- Medium5.3Missing Authorization
Trust Payments Gateway for WooCommerce
<3.1.0Update to 3.1.0
- Medium6.47.5.55.7211 - Authenticated (Contributor+) Server-Side Request Forgery
FV Flowplayer Video Player
7.5.44.7212 – 7.5.55.7211Update to 7.5.55.7212
- Medium4.9Authenticated (Editor+) SQL Injection
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.8.8Update to 3.8.9
- Low2.7Missing Authorization
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤4.3.3Update to 4.3.4
- Medium5.3Missing Authorization
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤10.31.8Update to 10.31.9
- Medium5.3Missing Authorization
WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect
<7.8.8.2Update to 7.8.8.2