Database
Critical WordPress vulnerabilities (page 90)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Betheme
≤28.5.8No patch available
- Medium5.3Missing Authorization
elegro Crypto Payment
≤1.0.1No patch available
- Medium5.3Unauthenticated Payment Bypass
Deema Payment Gateway
≤1.1.2No patch available
- Medium5.3Unauthenticated Payment Bypass
Deema Payment Gateway
≤1.1.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
UpSolution Core
≤8.44No patch available
- Medium5.3Unauthenticated Information Exposure
Slider Pro
≤1.0.0No patch available
- Medium4.3Missing Authorization
SmartyParcel Shipping – DHL Express, GLS, InPost & Nova Post for WooCommerce
≤1.23.2Update to 1.23.3
- Medium4.3Cross-Site Request Forgery
Featured Image from URL (FIFU)
≤6.0.7Update to 6.0.8
- High7.5Unauthenticated SQL Injection
tagDiv Opt-In Builder
≤1.7.6Update to 1.7.7
- High7.5Pay Writer <= 12.0.1 - Unauthenticated SQL Injection
JNews - Pay Writer
≤12.0.1Update to 12.0.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
Taskbuilder – Project Management & Task Management Tool With Kanban Board
≤6.0.5Update to 6.0.6
- Medium5.3Missing Authorization to Unauthenticated Settings Update
워드프레스 결제 심플페이 – 우커머스 결제 플러그인
≤5.5.17Update to 5.5.18
- High7.2Unauthenticated Stored Cross-Site Scripting
VikBooking Hotel Booking Engine & PMS
≤1.8.14Update to 1.8.15
- High7.2Unauthenticated Stored Cross-Site Scripting
JetBlog
≤2.4.10Update to 2.4.10.1
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Pay with Vipps and MobilePay for WooCommerce
≤6.2.0Update to 6.2.1
- Medium4.3Missing Authorization
File Media Renamer
≤1.3No patch available
- Medium4.3Cross-Site Request Forgery
Wallstreet
≤2.8.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute
Twenty20 Image Before-After
≤2.0.5Update to 2.0.6
- Critical9.1Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.11.0.5Update to 2.11.0.6
- Medium4.3Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
≤3.7.1Update to 3.7.2
- High8.1Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
Nelio Content – Editorial Calendar & Social Media Auto-Posting
≤4.5.0Update to 4.5.1
- Medium6.1Reflected Cross-Site Scripting via 'thumb_url' Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.46Update to 1.8.47
- Medium6.1Reflected Cross-Site Scripting via REQUEST_URI
WPFront Notification Bar
≤3.5.1Update to 3.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
WPC Product Options for WooCommerce
≤4.0.5Update to 4.0.6
- Medium6.1Reflected Cross-Site Scripting via 'rule_data' Parameter
WPC Estimated Delivery Date for WooCommerce
≤4.0.1Update to 4.0.2
- Medium5.4Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
WPMobile.App – Android and iOS App Builder
≤11.84Update to 11.85
- Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)
WP Ultimate Review
≤2.4.3Update to 2.4.4
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter
WP Ultimate Review
≤2.4.3Update to 2.4.4
- High7.5Unauthenticated SQL Injection via 'fullRef' Parameter
WP Visitor Statistics (Real Time Traffic)
≤8.7Update to 8.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
Mail logging & Catcher
≤2.1.12Update to 2.2.0