Database
Critical WordPress vulnerabilities (page 67)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
WPCOM Member
≤1.7.27Update to 1.8.0
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
WP Photo Album Plus
≤9.3.03.002Update to 9.3.03.003
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤4.3.12Update to 4.3.13
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
WP Meteor Website Speed Optimization Addon
≤3.4.18Update to 3.4.19
- Medium5.4Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.5Update to 6.2.6
- High7.2Authenticated (Custom+) PHP Object Injection via 'value' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Critical9.1Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
PPOM – Product Addons & Custom Fields for WooCommerce
≤34.0.10Update to 34.0.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
ACF Frontend Admin by DynamiApps
≤3.28.36Update to 3.29.1
- High8.1Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
WP File Download
≤6.3.9Update to 6.3.10
- Medium6.1Reflected Cross-Site Scripting via 'fvrt_' prefix
Favicon Rotator
≤1.2.11Update to 1.2.12
- Medium5.3Missing Authorization to Unauthenticated PNG File Upload
WP CV Builder
≤1.3.1Update to 1.3.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
WP Booking System – Booking Calendar
≤2.1.0.1Update to 2.1.0.2
- Medium6.1Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
Payment Plugins for Stripe WooCommerce
≤4.0.17Update to 4.0.18
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- High7.2Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
VikBooking Hotel Booking Engine & PMS
≤1.8.15Update to 1.8.16
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.34.8Update to 2.34.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
Team – Team Members Showcase Plugin
≤6.0.2Update to 6.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via display_name User Field
Post Grid Gutenberg Blocks – PostX
≤5.1.0Update to 5.1.1
- Low3.7Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
SpeedyCache – Cache, Optimization, Performance
≤1.4.2Update to 1.4.3
- Medium6.5Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
SiteOrigin Widgets Bundle
≤1.74.3Update to 1.75.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
Simple Membership
≤4.8.4Update to 4.8.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
≤2.4.0Update to 2.4.1
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
Responsive Lightbox & Gallery
≤2.7.9Update to 2.7.10
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.6Update to 11.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
Presto Player
≤4.5.1Update to 4.5.2
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
Post Export Import with Media
≤1.17.1Update to 1.17.2
- Medium4.9Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.13.2Update to 1.13.3
- High7.2Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
Podlove Podcast Publisher
≤4.5.6Update to 4.5.7
- Medium5.3Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
Order Export & Order Import for WooCommerce
≤2.7.8Update to 2.7.9