CWE-98Vulnerability type
WordPress Local File Inclusion vulnerabilities (page 107)
Template or module loaders that include attacker-chosen files, often leading to code execution.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint
OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA
≤1.1.7Update to 1.1.8
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
Customer Reviews for WooCommerce
≤5.120.0Update to 5.121.0
- Medium6.4Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.0.4Update to 3.0.5
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤3.0.4Update to 3.0.5
- Critical9.1Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium5.3Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
Online Scheduling and Appointment Booking System – Bookly
≤28.2Update to 28.3
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers
Blog2Social: Social Media Auto Post & Scheduler
≤9.1.0Update to 9.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting via first_name Parameter
BA Book Everything
≤1.8.27Update to 1.8.28
- Critical9.8Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
Wawp Country Code & Chat Widget for WooCommerce
≤4.8.6Update to 4.8.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
AMP for WP – Accelerated Mobile Pages
≤1.1.16Update to 1.1.17
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode
CSS & JavaScript Toolbox
≤12.0.6Update to 12.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job
Fancy Product Designer
≤6.5.2Update to 6.5.3
- Medium4.3Authenticated (Subscriber+) Information Exposure
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High7.5Authenticated (Subscriber+) PHP Object Injection
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
≤6.5.5Update to 6.5.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
GiveWP – Donation Plugin and Fundraising Platform
≤4.16.9Update to 4.17.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Table & List Builder for WooCommerce
≤5.6.7Update to 5.6.9
- Medium5.3Missing Authorization
Testimonials Widget
≤4.0.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
YITH WooCommerce Ajax Search
≤2.28.0Update to 2.28.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
Simply Schedule Appointments
≤1.6.12.31Update to 1.6.12.33
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.4.27Update to 6.4.28
- Medium4.3Authenticated (Contributor+) Information Exposure
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Review Slider Pro
≤12.7.11Update to 12.7.12
- Medium4.3Missing Authorization
MCP Server for WordPress – Connect Claude, ChatGPT & Gemini | AtlasMCP
≤1.8.1Update to 1.8.2
- Medium6.3Authenticated (Shop Worker+) Privilege Escalation
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤4.7.2Update to 4.7.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
ThemeREX Addons
<2.45.0Update to 2.45.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
≤1.26.15Update to 1.26.16
- Medium4.3Cross-Site Request Forgery
Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification
≤2.3.1Update to 2.3.2
- Medium6.6Authenticated (Editor+) PHP Object Injection
Ultra Addons for Contact Form 7
≤3.5.51Update to 3.5.52
- Medium6.3Authenticated (Subscriber+) Security Control Bypass
All-In-One Security (AIOS) – Security and Firewall
≤5.4.8Update to 5.4.9
- Medium5.3Missing Authorization
Customer Reviews for WooCommerce
≤5.120.0Update to 5.121.0