Database
Critical WordPress vulnerabilities (page 80)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Administrator+) Arbitrary File Upload
AWP Classifieds
≤4.4.8Update to 4.4.9
- High7.5Unauthenticated Denial of Service
WP Rocket
<3.23.5Update to 3.23.5
- High8.1Unauthenticated Local File Inclusion
The Voux - A Multipurpose News & Magazine WordPress Theme
≤6.9.5No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
colorit
≤1.3No patch available
- High8.1Creative Portfolio WordPress Theme <= 4.8.3 - Unauthenticated Local File Inclusion
Werkstatt - Creative Portfolio WordPress Theme
≤4.8.3No patch available
- Medium6.1Sports Club <= 4.2 - Reflected Cross-Site Scripting
Whistle - Sports Clothing & Fitness Equipment
≤4.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Ogency - Web Design Agency WordPress Theme
≤1.0.0No patch available
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
FooSales – Point of Sale (POS) for WooCommerce
≤1.43.2Update to 1.43.3
- Medium5.3Missing Authorization
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)
≤1.13.1Update to 1.13.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)
≤1.13.1Update to 1.13.6
- Medium6.1Reflected Cross-Site Scripting
kuteshop
≤4.2.9No patch available
- High8.1Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Unauthenticated Local File Inclusion
Biolife - Organic Food WordPress Theme ( RTL Supported )
≤3.2.3No patch available
- Medium6.1Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Reflected Cross-Site Scripting
Biolife - Organic Food WordPress Theme ( RTL Supported )
≤3.2.3No patch available
- High8.1Architecture and Interior Design WordPress Theme <= 1.8 - Unauthenticated Local File Inclusion
Aalto - Architecture and Interior Design WordPress Theme
≤1.8No patch available
- High8.1Unauthenticated PHP Object Injection
CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor
≤1.5.0No patch available
- High7.5Authenticated (Subscriber+) PHP Object Injection
Dynamic User Directory
≤2.4No patch available
- Medium4.9Authenticated (Administrator+) SQL Injection
Leyka
≤3.32.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.47Update to 1.8.48
- Medium6.5Authenticated (Subscriber+) SQL Injection
Qode Tours
≤3.1.3.2No patch available
- High8.1Unauthenticated Local File Inclusion
Kids Care | Children & Child Care WordPress Theme
≤3.2.4No patch available
- Low2.7Missing Authorization
Code Snippets
≤3.9.0Update to 3.10.0
- Medium4.3Missing Authorization
Th Shop Mania
≤1.9.1Update to 1.9.2
- High7.2Unauthenticated Stored Cross-Site Scripting
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.1.0Update to 11.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤6.3.10Update to 6.3.11
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Metadata
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.3.1Update to 6.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
JetElements
≤2.9.2.2Update to 2.9.2.3
- Medium5.37.0.2 - Missing Authorization
Livees Checkout
6.8 – 7.0.2Update to 7.0.3
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Settings Update
Pubjet | پابجت
≤5.4.8No patch available
- Medium5.3Unauthenticated Information Exposure
SendPress Newsletters
≤1.26.1.20No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.6Update to 7.4.7