Database
Critical WordPress vulnerabilities (page 99)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Contributor+) PHP Object Injection
Schema & Structured Data for WP & AMP
≤1.66Update to 1.67
- High7.5Authenticated (Contributor+) PHP Object Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.46Update to 1.8.47
- Medium4.3Missing Authorization
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
≤4.2.14Update to 4.2.15
- High7.2Unauthenticated Stored Cross-Site Scripting
JetEngine
≤3.8.15.3Update to 3.8.15.4
- Medium6.6Authenticated (Editor+) PHP Object Injection
Page Builder by SiteOrigin
≤2.36.0Update to 2.36.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.15.3Update to 3.15.5
- High7.2Unauthenticated Stored Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤3.13.1Update to 3.13.2
- Medium5.3Unauthenticated Insecure Direct Object Reference
Pay with Vipps and MobilePay for WooCommerce
≤6.2.4Update to 6.2.5
- Critical9.8Unauthenticated Remote Code Execution
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤11.0.5Update to 11.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Persistent Login
≤3.1.3Update to 3.1.4
- High7.2Unauthenticated Stored Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.1Update to 1.10.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Photo Album Plus
≤9.3.02.003Update to 9.3.03.002
- High7.2Unauthenticated Stored Cross-Site Scripting
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.5.5Update to 1.6.1
- High7.2Unauthenticated Stored Cross-Site Scripting
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.13.1Update to 1.13.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
≤1.14.6Update to 1.15.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤11.2.6Update to 11.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Premmerce Permalink Manager for WooCommerce
≤2.3.13Update to 2.3.16
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
CMB2
≤2.13.0Update to 2.13.1
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
Newsletters, Email Marketing, SMS and Popups by Omnisend
≤1.9.0Update to 1.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Visual Composer Website Builder
≤45.16.2Update to 45.16.3
- Medium5.4Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Advanced Woo Labels – Product Labels & Badges for WooCommerce
≤2.51Update to 2.52
- Medium4.9Authenticated (Administrator+) SQL Injection
WP Activity Log
≤5.6.6Update to 5.6.7
- Medium5.3Unauthenticated Information Exposure
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
≤1.12.26Update to 1.12.27
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Cool FormKit Lite – Advanced Form Builder for Elementor
≤2.7.8Update to 2.7.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder
≤51.1.86Update to 51.1.87
- Medium6.5Authenticated (Contributor+) SQL Injection
Event Tickets and Registration
≤5.29.5Update to 5.29.5.1
- Medium4.3Missing Authorization
The Events Calendar
≤6.17.5Update to 6.17.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Polylang
≤3.8.9Update to 3.8.10
- Medium5.3Unauthenticated Authentication Bypass
OAuth Single Sign On – SSO (OAuth Client)
≤7.1.2Update to 7.1.3
- Medium5.3Unauthenticated Information Exposure
Notivo Notification for WooCommerce
≤1.4.2Update to 1.4.3