Database
Critical WordPress vulnerabilities (page 64)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.9.17Update to 1.10.0
- Medium4.3Cross-Site Request Forgery
Patreon WordPress
≤1.10.0Update to 1.11.0
- Medium5.3Missing Authorization
Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon
≤1.3.0Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.11.110Update to 4.11.111
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium5.3Missing Authorization
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.58.0Update to 1.58.1
- Medium4.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.8Update to 8.8.9
- Medium4.3Missing Authorization
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤7.3.6Update to 7.3.7
- Medium4.3Missing Authorization
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams
≤7.5.13Update to 7.5.14
- Medium5.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.28Update to 1.0.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤2.8.18Update to 2.8.19
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetMenu
≤3.0.5Update to 3.0.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.3Update to 2.9.2.4
- Medium4.3Missing Authorization
Flexible Subscriptions
≤1.8.4Update to 1.8.5
- Medium4.3Missing Authorization
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.9.22Update to 2.9.23
- Medium5.3Missing Authorization
Products Restricted Users for WooCommerce
≤0.7Update to 0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Query Blocks
≤5.6.0Update to 5.7.0
- Medium4.3Missing Authorization
Event Post
≤6.1.1Update to 6.1.2
- Medium4.3Missing Authorization
TMDS – Dropshipping for TEMU and Woo
≤1.0.15Update to 1.0.16
- Medium4.3Missing Authorization
VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok
≤1.2.10Update to 1.2.11
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Event Post
≤6.1.1Update to 6.1.2
- Medium5.3Missing Authorization
Bus Ticket Booking with Seat Reservation
≤5.9.7Update to 5.9.8
- Medium5.3Missing Authorization
Push Notification for Post and BuddyPress
≤3.23Update to 3.24
- Medium6.6Authenticated (Editor+) PHP Object Injection
Polylang
≤3.8.9Update to 3.8.10
- High8.1Real Estate WordPress Theme <= 1.3.13 - Unauthenticated PHP Object Injection
Good Homes - Real Estate WordPress Theme
≤1.3.13No patch available
- High8.1Unauthenticated PHP Object Injection
gamezone
≤1.1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Edge Decor
≤2.9No patch available
- High8.1Unauthenticated PHP Object Injection
Bonbon
≤1.11No patch available
- High8.1Unauthenticated PHP Object Injection
Filmax | Cinema & Movie News Magazine WordPress Theme
≤1.1.11No patch available