Database
Critical WordPress vulnerabilities (page 71)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
BuddyPress Instant Chat
≤1.6No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Adwised Web Push Notification
≤2.5.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
HootBoard – Bulletin Board For Your Organization & Team Communication
≤3.1.4No patch available
- Medium5.3Missing Authorization
Insurify – Order & Shipping Protection
≤1.0No patch available
- Medium5.3Missing Authorization
Quick quotes – WPSHARE247
≤1.0.0No patch available
- Medium5.3Missing Authorization
Insurify – Order & Shipping Protection
≤1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
click5 CRM add-on to Gravity Forms
≤1.0.3No patch available
- Medium5.3Missing Authorization
click5 CRM add-on to WPForms
≤1.0.3No patch available
- Medium5.3Missing Authorization
click5 CRM add-on to Ninja Forms
≤1.0.1No patch available
- Medium5.5Authenticated (Editor+) Server-Side Request Forgery
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium4.3Cross-Site Request Forgery
Hotel Booking
≤3.8No patch available
- Medium5.3Missing Authorization
Fundiin cho WooCommerce
≤3.4.0No patch available
- High7.5Unauthenticated SQL Injection
Tcard WP
≤1.8.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤5.2.5Update to 5.2.6
- Medium5.3Missing Authorization
Restrict User Access – Ultimate Membership & Content Protection
≤2.8.1Update to 2.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.5Update to 3.13.6
- High8.1Unauthenticated Local File Inclusion
TouchUp - Cosmetic and Plastic Surgery WordPress Theme
<1.4Update to 1.4
- Medium6.5Authenticated (Contributor+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
4.0.0 – <4.1.0Update to 4.1.0
- Medium4.3Missing Authorization
Squadeno – Club Sports Manager
≤1.11.0Update to 1.12.0
- Medium4.3Authenticated (Subscriber+) Payment Bypass
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
≤3.2.9Update to 3.2.10
- Medium4.3Missing Authorization
AutoPoly – AI Translation For Polylang
≤1.6.2Update to 1.6.3
- Medium5.3Missing Authorization
WeddingCity Lite – Wedding Directory and Listing
≤1.0.4No patch available
- High7.2Authenticated (Admin+) Arbitrary Plugin Installation
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.1Update to 1.16.2
- Critical9.8Unauthenticated Arbitrary File Upload
Anton Extensions
≤1.2.2No patch available
- Medium4.3Authenticated (Subscriber+) Information Exposure
WP-Invoice – Web Invoice and Billing
≤4.3.1No patch available
- High7.5Unauthenticated SQL Injection
Datalist it
≤0.0.3No patch available
- Medium5.3Missing Authorization
WP Posts Password Batch Manager
≤1.1No patch available
- High7.5Unauthenticated SQL Injection
WP-Partner
≤1.2.1No patch available
- High7.5Unauthenticated SQL Injection
Llavero.io
≤0.1.4No patch available