CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 1294)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Authenticated Local File Inclusion
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.24Update to 1.5.25
- Medium5.4Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.4.7Update to 2.4.7
- Medium5.4Authenticated Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.22Update to 1.5.23
- High7.5Unauthenticated Arbitrary File Read
diarise
≤1.5.9No patch available
- High8.8Authenticated SQL Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
<1.13.3Update to 1.13.3
- Medium5.4Authenticated Cross-Site Scripting
Custom Field Suite
≤2.5.14Update to 2.5.15
- Medium5.3Unauthenticated Comment Creation
WPGraphQL
≤0.2.3Update to 0.3.0
- Critical9.8Administrative User Creation
WPGraphQL
≤0.2.3Update to 0.3.0
- Critical9.1Information Exposure
WPGraphQL
≤0.2.3Update to 0.3.0
- Medium6.1Cross-Site Scripting
Ultimate FAQ Accordion Plugin
<1.8.22Update to 1.8.22
- High7.5Information Exposure
Gravity Forms
≤2.4.8Update to 2.4.9
- Critical9.8Arbitrary File Upload
wp-live-chat-support-pro
≤8.0.26Update to 8.0.27
- Critical9.8PHP Object Injection
Carts Guru
≤1.4.5Update to 1.4.6
- Critical9.8PHP Object Injection
Virim
≤0.4No patch available
- High7.5Sensitive Information Disclosure
WP Backup+
≤2018-11-22No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
User Submitted Posts – Enable Users to Submit Posts from the Front End
<20190426Update to 20190426
- Medium6.1Reflected Cross-Site Scripting
Blog2Social: Social Media Auto Post & Scheduler
<5.0.3Update to 5.0.3
- Medium6.1Unauthenticated Cross-Site Scripting
My Calendar – Accessible Event Manager
≤3.1.9Update to 3.1.10
- Critical9.8SQL Injection
RSVPMaker
≤6.1.9Update to 6.2
- Critical9.8Server-Side Request Forgery
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
≤1.6.6Update to 1.6.7
- High7.5Unauthenticated Arbitrary Media Deletion
Checkout Field Manager (Checkout Manager) for WooCommerce
≤4.2.6Update to 4.3
- Critical9.8Unauthenticated OS Command Injection
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<5.2Update to 5.2
- Medium6.4Stored Cross-Site Scripting
JobCareer | Job Board Responsive WordPress Theme
<2.5.1Update to 2.5.1
- High8.8Cross-Site Request Forgery
WDContactFormBuilder
<1.0.69Update to 1.0.69
- Medium6.1Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.1.1Update to 5.1.2
- Medium6.4Authenticated Stored Cross-Site Scripting
CarSpot – Dealership Wordpress Classified Theme
<2.1.7Update to 2.1.7
- Critical9.8Arbitrary File Upload
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
<2.0.1Update to 2.0.1
- Medium6.1Reflected Cross-Site Scripting via URL parameter
MailPoet – Newsletters, Email Marketing, and Automation
<3.23.2Update to 3.23.2
- High8.1PHP Object Injection
OptionTree
≤2.6.0Update to 2.7.0
- Medium6.1Cross-Site Scripting
Download Manager
<2.9.94Update to 2.9.94