Database
Critical WordPress vulnerabilities (page 96)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
AFFI – Affiliate Marketing for WooCommerce
≤1.0.9Update to 1.0.10
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.0Update to 1.2.1
- Medium5.3Missing Authorization
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
≤1.2.0Update to 1.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.14Update to 6.2.15
- Medium4.3Missing Authorization
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program
≤4.6.3Update to 4.6.4
- Medium5.3Missing Authorization
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium5.3Missing Authorization
Site Reviews
≤8.3.2Update to 8.3.3
- Medium6.5Authenticated (Contributor+) SQL Injection
Unlimited Elements for Elementor
≤2.0.20Update to 2.0.21
- Medium4.3Cross-Site Request Forgery
Memberful – Membership Plugin
≤1.81.0Update to 1.81.1
- High7.2Unauthenticated Stored Cross-Site Scripting
MaxGalleria
≤6.5.3Update to 6.5.4
- Medium5.3Unauthenticated Insecure Direct Object Reference
REST API Log
≤1.7.2Update to 1.7.3
- Medium5.3Unauthenticated Insecure Direct Object Reference
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.1Update to 3.13.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Parallax Section Block – Add Parallax Scrolling Effects to Sections
≤2.0.4Update to 2.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Premmerce Wishlist for WooCommerce
≤1.1.13Update to 1.1.15
- Medium5.3Missing Authorization
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤8.5.6Update to 8.5.7
- Medium5.3Missing Authorization
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
3.1.0 – 3.1.0Update to 3.1.1
- Medium6.6Authenticated (Editor+) PHP Object Injection
Hide Shipping Method For WooCommerce
≤1.5.4Update to 1.5.5
- High7.5Authenticated (Contributor+) PHP Object Injection
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
≤3.1.31Update to 3.1.44
- Medium5.3Unauthenticated Information Exposure
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤9.1Update to 9.2
- High7.5Unauthenticated SQL Injection
Iptanus File Upload
≤5.1.10Update to 5.2.0
- Medium5.3Unauthenticated Insecure Direct Object Reference
Revopic – Photo Reviews for WooCommerce
≤1.2.30Update to 1.2.31
- Medium5.3Missing Authorization
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.14Update to 6.2.15
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
LA-Studio Element Kit for Elementor
≤1.6.2Update to 1.6.3
- Medium5.3Unauthenticated Information Exposure
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤4.3.0Update to 4.3.1
- Medium5.3Unauthenticated Persistent Page Denial of Service
WP Ultimate Review
≤2.4.3Update to 2.4.4
- Medium5.3Unauthenticated Information Exposure
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.4.13Update to 3.8.4.14
- Critical9.1Unauthenticated Arbitrary File Deletion
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.0.5Update to 11.1.0
- Medium4.3Authenticated (Translator+) Limited File Read
Loco Translate
≤2.8.8Update to 2.8.9
- Medium6.52.0.20 - Authenticated (Subscriber+) SQL Injection
Unlimited Elements for Elementor
1.5.142 – 2.0.20Update to 2.0.21
- Medium5.3Unauthenticated Privileged POS Session Hijacking
TillKit – Mobile POS for WooCommerce
≤1.0.4Update to 1.0.5