Database
Critical WordPress vulnerabilities (page 82)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated PHP Object Injection
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
≤6.2.1Update to 6.2.2
- Medium5.3Unauthenticated Unauthorized Account Creation
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.0Update to 3.7.1
- Medium5.3Unauthenticated Unauthorized User Account Creation
TutorStarter
≤4.0.3Update to 4.0.4
- Critical9.8Unauthenticated Remote Code Execution
SiteVault – Backup, Restore, Migration & Cloning
≤1.5.19Update to 1.5.20
- High7.2Unauthenticated Stored Cross-Site Scripting
WP File Download
≤6.3.6No patch available
- High8.8Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
ACPT (Premium)
≤2.0.66Update to 2.0.67
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Slider
≤1.1.130No patch available
- High8.1Unauthenticated PHP Object Injection
The GDPR Framework By Data443
≤2.5.0Update to 2.5.1
- Medium5.3Missing Authorization
WCFM – Multivendor Marketplace REST API for WooCommerce
≤1.6.3No patch available
- High7.5Unauthenticated SQL Injection
SendPress Newsletters
≤1.26.1.20No patch available
- Medium5.3Missing Authorization
Advanced Posts Listing – Show Post List Easily
≤1.0.8No patch available
- Medium5.3Missing Authorization
10WebSocial
≤1.4.35No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Front End PM
≤11.4.6Update to 11.4.7
- Medium5.3Unauthenticated Information Exposure
Mailjet Email Marketing
≤6.2.3Update to 6.2.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Ansar Import – Starter Sites & Template Library
≤2.1.2Update to 2.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.3.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Document Gallery
≤5.1.1Update to 5.1.2
- High7.5Unauthenticated SQL Injection
Gmedia Photo Gallery
≤1.25.1Update to 1.25.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Hotel Booking
≤3.8No patch available
- High7.3Unauthenticated Privilege Escalation
Doctreat Core
≤1.7.0No patch available
- Medium6.3Job Board WordPress Theme <= 2.2 - Authenticated (Subscriber+) Privilege Escalation
JobZilla - Job Board WordPress Theme
≤2.2No patch available
- High7.2Authenticated (Editor+) Remote Code Execution
Tabs Responsive – With WooCommerce Product Tabs Extension
≤2.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.4.7Update to 1.4.8
- Critical9.8Hospitals and Doctors Directory WordPress Listing Theme <= 1.7.0 - Unauthenticated Arbitrary File Upload
Doctreat - Hospitals and Doctors Directory WordPress Listing Theme
≤1.7.0No patch available
- Medium6.5Authenticated (Subscriber+) Denial of Service
WPBase Cache
≤5.5.6Update to 5.5.7
- High7.2Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤4.0.1Update to 4.0.2
- Medium5.3Missing Authorization
The7 — Website and eCommerce Builder for WordPress
≤14.2.2No patch available
- Medium5.3Missing Authorization
Autoship Cloud for WooCommerce Subscription Products
≤2.17.1No patch available
- High7.5Unauthenticated SQL Injection
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events
≤1.0.21Update to 1.0.22
- Medium4.7Authenticated (Shop Manager+) Privilege Escalation
PDF Invoices & Packing Slips for WooCommerce – Challan Invoice Plugin
≤3.7.88No patch available