Database
Critical WordPress vulnerabilities (page 78)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Authenticated (Administrator+) SQL Injection
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.279Update to 1.0.280
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Image Photo Gallery Final Tiles Grid
<3.6.14Update to 3.6.14
- High7.33.0.4 - Unauthenticated Privilege Escalation
Frontend Dashboard
3.0.0 – 3.0.4Update to 3.0.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Thanko Thank You Page Customizer for WooCommerce
≤1.2.3Update to 1.2.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- Critical9.1Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
Super Forms – Drag & Drop Form Builder
≤6.3.316Update to 6.3.317
- High8.1Multipurpose eCommerce Template <= 1.3.0 - Unauthenticated Local File Inclusion
Duka Market - Multipurpose eCommerce Template
≤1.3.0No patch available
- High8.1Multipurpose WooCommerce Theme <= 1.0.9 - Unauthenticated Local File Inclusion
Uminex - Multipurpose WooCommerce Theme
≤1.0.9No patch available
- Medium5.3Missing Authorization
DK
≤3.2.1No patch available
- Medium6.1Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 - Reflected Cross-Site Scripting
Kids Planet - Children Kindergarten and Playgroup WordPress Theme
≤2.2.14.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
≤4.0.0Update to 4.0.1
- Medium6.5Authenticated (Author+) SQL Injection
Slider by 10Web – Responsive Image Slider
≤1.2.63No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
≤7.6.1.1Update to 7.7.0
- Medium5.4Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
≤5.6.9Update to 5.6.10
- Medium6.1Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
Aurora Heatmap
≤1.7.2Update to 1.7.3
- Medium4.9Authenticated (Administrator+) SQL Injection
Post title marquee scroll
≤9.9No patch available
- Medium4.9Authenticated (Shop Manager+) SQL Injection
Pix por Piggly (para Woocommerce)
≤2.1.2No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
Dynamic User Directory
≤2.4No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.9.1Update to 3.9.2
- Medium5.3Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization
WP Rentals - Booking Accommodation WordPress Theme
≤3.14.2No patch available
- Medium4.3Missing Authorization
Booktics – Appointment Booking Calendar for Service Businesses
≤1.0.27Update to 1.0.28
- Medium5.3Unauthenticated Information Exposure
Modula Image Gallery – Photo Grid & Video Gallery
≤3.0.11Update to 3.0.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates
≤3.50.0Update to 3.50.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.6.2Update to 4.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.7Update to 11.2.8
- Medium4.3Missing Authorization
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.2Update to 7.8.14.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
≤2.4.0Update to 2.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.6Update to 8.8.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.41Update to 3.42
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons
≤8.8.6Update to 8.8.7