Database
Critical WordPress vulnerabilities (page 86)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- Medium5.3Unauthenticated Information Exposure
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤7.4.5Update to 7.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
bBlocks – Essential Gutenberg Blocks & Patterns Collection
≤2.1.8Update to 2.1.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
≤3.6.13Update to 3.6.14
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
≤3.0.0Update to 4.0.0
- Medium5.3Unauthenticated Mail Relay
Magee Shortcodes
≤2.1.1No patch available
- Critical9.8Unauthenticated Privilege Escalation
Tourfic Pro
≤1.17.3No patch available
- Medium5.37.6.2 - Missing Authorization
Nexi XPay Build
7.0.0 – 7.6.2No patch available
- Medium4.3Authenticated (Subscriber+) Information Exposure
User Private Files – Secure File Sharing and Client Portal Plugin
≤2.1.8Update to 2.1.9
- Medium4.34.2.14 - Authenticated (Subscriber+) Information Exposure
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
4.0.0 – 4.2.14Update to 4.2.15
- Medium5.3Missing Authorization
Fluent Forms Pro Add On Pack
≤6.2.13Update to 6.2.14
- Medium6.31.1.4 - Authenticated (Subscriber+) Privilege Escalation
Koinonia Link
1.1.2 – 1.1.4Update to 1.1.5
- Medium5.3Unauthenticated Information Exposure
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
≤3.0.20Update to 3.0.21
- Medium5.37.6.2 - Unauthenticated Payment Bypass
Nexi XPay Build
7.2.2 – 7.6.2No patch available
- Medium5.3Unauthenticated Login Protection Bypass
Advanced Google reCAPTCHA
≤5.40Update to 5.41
- Medium4.32-Factor Authentication Bypass
WP Synchro – The Ultimate WordPress Migration Tool
≤1.16.1Update to 1.16.2
- Medium5.3Missing Authorization to Unauthenticated Settings Update
TrueBooker – Appointment Booking and Scheduler System
≤1.2.9Update to 1.3.0
- Medium4.3Missing Authorization
Simple JWT Login – Allows you to use JWT on REST endpoints.
4.0.0 – 4.0.0No patch available
- Medium5.3Missing Authorization
Fluent Affiliate Pro
≤1.6.4Update to 1.6.5
- Medium5.3Missing Authorization
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms
≤5.2.8No patch available
- Medium5.3Missing Authorization
Graphina – Charts and Graphs For Elementor
≤3.1.12Update to 3.1.13
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
Job Postings
≤2.8.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Magee Shortcodes
≤2.1.1No patch available
- Medium4.3Missing Authorization
Unlimited Elements for Elementor
≤2.0.22Update to 2.0.23
- Medium4.3Missing Authorization
CP Media Player – Audio Player and Video Player
≤1.3.3Update to 1.3.4
- High7.24.5.1 - Authenticated (Editor+) Remote Code Execution
WP Coder – Insert & Manage Code Snippets
4.0 – 4.5.1Update to 4.5.2
- Medium4.9Authenticated (Editor+) SQL Injection
Animated Number Counters
≤3.0Update to 3.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
≤1.16.0Update to 1.16.1
- Medium4.3Authenticated (Contributor+) Protected Post Content Disclosure
Memberful – Membership Plugin
≤1.81.2Update to 1.82.0
- Medium5.33.1.0 - Unauthenticated Information Exposure
Geliver Akıllı Kargo Pazaryeri
3.0.0 – 3.1.0Update to 3.1.1