CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 1307)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Emag Marketplace Connector
<1.0.1Update to 1.0.1
- Medium5.4Cross-Site Scripting
amtyThumb posts
≤8.2.0No patch available
- High8.8Authenticated PHP Object Injection
WooCommerce
<3.2.4Update to 3.2.4
- Medium6.4Stored Cross-Site Scripting
Affiliate Ads for Clickbank Products
≤1.6Update to 1.7
- High8.3Unauthenticated Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
- Medium5.3Unauthenticated Information Disclosure
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
- Critical9.8Authentication Bypass
UserPro - Community and User Profile WordPress Plugin
<4.9.17.1Update to 4.9.17.1
- Medium6.1Cross-Site Scripting
Simple Membership
<3.5.7Update to 3.5.7
- Medium6.1Reflected Cross-Site Scripting
Ultimate Instagram Feed – WordPress Plugin
<1.3Update to 1.3
- Medium6.1Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.28Update to 1.2.30
- Medium6.1Cross-Site Scripting
Content Cards
≤0.9.6Update to 0.9.7
- Medium6.1Cross-Site Scripting
Football Pool
<2.6.5Update to 2.6.5
- High8.8SQL Injection
JTRT Responsive Tables
<4.1.2Update to 4.1.2
- Critical9.8SQL Injection due to Double Prepare approach
WordPress
≤4.8.2Update to 3.7.23 or 3.8.23 or 3.9.21 or 4.0.20 or 4.1.20 or 4.2.17 or 4.3.13 or 4.4.12 or 4.5.11 or 4.6.8 or 4.7.7 or 4.8.3
- High8.8Authenticated Remote Code Execution
Shortcodes Ultimate – Content Elements
<5.0.1Update to 5.0.1
- Medium6.1Cross-Site Scripting
User Login History
<1.6Update to 1.6
- Critical9.8SQL Injection to PHP Object Injection
Contact Form for WordPress – Ultimate Form Builder Lite
<1.3.7Update to 1.3.7
- Medium6.1Cross-Site Scripting
Easy Appointments
<1.12.0Update to 1.12.0
- Medium6.1Reflected Cross-Site Scripting
External Media without Import
<1.0.0Update to 1.0.0
- Medium6.1Reflected Cross-Site Scripting
PopCash Code Integration Tool
<1.1Update to 1.1
- Medium5.4Reflected Cross-Site Scripting
pootle button
≤1.1.1Update to 1.2.0
- Medium6.1Authenticated Cross-Site Scripting
Max Mega Menu
≤2.3.8Update to 2.4
- High7.2Stored Cross-Site Scripting
Quards
all versionsNo patch available
- Medium4.7Cross-domain Flash injection
WordPress
≤4.9.1Update to 3.7.25 or 3.8.25 or 3.9.24 or 4.0.22 or 4.1.22 or 4.2.19 or 4.3.15 or 4.4.14 or 4.5.13 or 4.6.10 or 4.7.9 or 4.8.5 or 4.9.2
- Medium5.3All Known Versions - Cleartext Storage of wp_signups.activation_key
WordPress
all versionsNo patch available
- Critical9.8SQL Injection
Simple Login Log
<1.1.2Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
My WP Translate
≤1.0.3Update to 1.0.4
- Critical9.8SQL Injection
Simple Login Log
<1.1.2Update to 1.1.2
- High8.0Unprotected AJAX Actions
My WP Translate
<1.0.4Update to 1.0.4
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.6Update to 3.4.6