Database
Critical WordPress vulnerabilities (page 84)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Server-Side Request Forgery
Instapage Plugin
≤3.7.2Update to 3.7.3
- Medium5.3Unauthenticated Information Exposure
Edwiser Bridge – WordPress Moodle Integration
≤4.3.4No patch available
- Medium4.3Missing Authorization
Wise Chat
≤3.4.3Update to 3.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.7.6No patch available
- High7.5Unauthenticated SQL Injection
Booknetic
≤4.8.5No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Woffice CRM
≤5.4.35No patch available
- Medium4.3Missing Authorization
App for Cloudflare®
≤1.10.1No patch available
- Medium5.3Missing Authorization
PayPlug for WooCommerce (Official)
≤3.1.0Update to 3.1.1
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
Piotnet Addons For Elementor
≤7.1.71No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Appointment Bookings for Zoom GoogleMeet and more – Wappointment
≤2.7.7No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
WP Duplicate – WordPress Migration Plugin
≤1.1.11No patch available
- High7.3Unauthenticated Privilege Escalation
Taskbot
≤6.6No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Taskbot
≤6.6No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Midtrans-WooCommerce
≤2.32.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Mapster WP Maps
≤2.0.4Update to 2.0.5
- Medium4.3Authenticated (Contributor+) Information Exposure
Polylang
≤3.8.7Update to 3.8.8
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- Medium5.3Unauthenticated Information Exposure
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.8.3Update to 4.9
- Medium5.3Unauthenticated Information Exposure
XServer Migrator
≤1.6.6Update to 1.6.7
- Medium5.3Unauthenticated Information Exposure
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- High7.3Unauthenticated Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤4.0.0Update to 4.0.1
- Medium5.3Unauthenticated Information Exposure
Motors – Car Dealership & Classified Listings Plugin
≤1.4.124Update to 1.4.125
- High7.2Unauthenticated Stored Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.12.3Update to 1.8.13
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- High7.2Unauthenticated Stored Cross-Site Scripting
picu – Online Photo Proofing Gallery
≤3.10.1Update to 3.10.2
- Medium5.3Missing Authorization
picu – Online Photo Proofing Gallery
≤3.10.1Update to 3.10.2
- High7.3Unauthenticated Privilege Escalation
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.1.1Update to 3.1.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WP User Profiles
≤2.7.3Update to 2.7.4
- Medium5.3Missing Authorization
PowerPress Podcasting plugin by Blubrry
≤11.17.9Update to 11.17.11