CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 1275)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
<2.3.10Update to 2.3.10
- Medium4.3Cross-Site Request Forgery Bypass
10WebAnalytics
<1.2.9Update to 1.2.9
- Medium4.3Cross-Site Request Forgery Bypass
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.4.3Update to 2.4.3
- Medium4.3Cross-Site Request Forgery Bypass
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
<3.4.3Update to 3.4.3
- Medium4.3Cross-Site Request Forgery Bypass
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Medium4.3Cross-Site Request Forgery Bypass
WP Hotel Booking
<1.10.2Update to 1.10.2
- Medium4.3Cross-Site Request Forgery Bypass
WebberZone Top 10 — Popular Posts
<2.9.5Update to 2.9.5
- Medium4.3Cross-Site Request Forgery Bypass
Custom Field Template
<2.5.2Update to 2.5.2
- Medium4.3Cross-Site Request Forgery Bypass
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
<2.4.1Update to 2.4.1
- High8.8Cross-Site Request Forgery
Coming Soon & Maintenance Mode Page & Under Construction
≤1.57Update to 1.58
- Medium4.3Cross-Site Request Forgery Bypass
Menu Swapper
≤1.1.0.2Update to 1.1.1
- Medium4.3Cross-Site Request Forgery Bypass
Product Catalog Simple
<1.5.13Update to 1.5.13
- Medium4.3Cross-Site Request Forgery Bypass
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
<1.8.3Update to 1.8.3
- Critical9.8SQL Injection
DiveBook
≤1.1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
DiveBook
≤1.1.4No patch available
- Medium5.3Sensitive Information Disclosure via Directory Listing
Noo JobMonster
≤4.6.6Update to 4.6.6.1
- Medium5.3Unauthenticated Email Forgery
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<4.5.6Update to 4.5.6
- Critical9.8SQL Injection
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤7.11.17Update to 7.11.18
- Medium4.3Cross-Site Request Forgery Bypass
EWWW Image Optimizer
≤5.8.1Update to 5.9
- Medium5.5Constant Contact Forms <= 1.8.7 Editor+ Stored Cross-Site Scripting
Constant Contact Forms
<1.8.8Update to 1.8.8
- High7.2SQL injection
Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance
<3.0.2Update to 3.0.2
- Medium4.3Cross-Site Request Forgery
ActiveCampaign – The autonomous marketing platform
<8.0.2Update to 8.0.2
- Medium5.0Missing Authorization
NextScripts: Social Networks Auto-Poster
≤4.3.17Update to 4.3.18
- Critical9.8KEVPoCArbitrary File Upload/Remote Code Execution
File Manager
≤6.8Update to 6.9
- Medium5.4Cross-Site Scripting
Recall Products
≤0.8No patch available
- Medium5.4Stored Cross-Site Scripting
WP smart CRM & Invoices FREE
≤1.8.7No patch available
- Medium6.1Reflected Cross-Site Scripting
Subscribe Sidebar plugin by Blubrry
≤1.3.1No patch available
- High8.8Authenticated SQL Injection
Recall Products
≤0.8No patch available
- Medium6.1Cross-Site Scripting
Chamber Dashboard Business Directory
<3.3.1Update to 3.3.1
- High7.2SQL Injection
WordPress Poll
≤36No patch available