CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 27)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Flexible Chat – AI chatbot plugin for WordPress and WooCommerce
≤1.1.0Update to 1.1.1
- Medium5.3Missing Authorization
WP REST Cache
≤2026.3.1Update to 2026.4.0
- High7.5Unauthenticated SQL Injection
Transliterator – Multilingual and Multi-script Text Conversion
≤2.5.13Update to 2.5.14
- High8.1Unauthenticated PHP Object Injection
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤3.8.6.1Update to 3.8.6.2
- Medium4.3Missing Authorization
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
≤2.8.2Update to 2.8.3
- Medium4.3Authenticated (Subscriber+) Arbitrary Media Attachment Deletion
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.7.1Update to 3.6.8
- High8.7Authenticated (Administrator+) Arbitrary Table Deletion
Database Cleaner: Cleanup, Optimization & Repair
≤1.4.7Update to 1.4.8
- Medium6.5Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters
Spectra Legacy – Gutenberg Blocks
≤2.20.4Update to 2.20.5
- Medium6.5Unauthenticated Arbitrary Shortcode Injection
GIFTiT – Free Gifts for WooCommerce
≤4.5Update to 4.6
- Medium5.4Authenticated (Contributor+) Cross-Site Scripting
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder
≤2.9.5Update to 2.9.6
- Medium6.53.8.11 - Unauthenticated Arbitrary Shortcode Execution
My Calendar – Accessible Event Manager
3.8.8 – <3.8.11Update to 3.8.11
- High8.1Unauthenticated PHP Object Injection
Royal Event | Catering & Wedding Chef Wordpress Theme
≤2.0No patch available
- High7.2Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.7.1Update to 3.6.8
- Medium5.3Unauthenticated Information Exposure
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.97.14Update to 2.97.15
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Media Library Assistant
≤3.43Update to 3.44
- Medium5.3Unauthenticated reCAPTCHA Validation Bypass
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.2.4Update to 6.2.5
- Low2.7Missing Authorization
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.4.0Update to 6.4.1
- Medium5.3Unauthenticated Non-Public Product Data Disclosure
YITH WooCommerce Product Add-Ons
≤4.34.0Update to 4.34.1
- Medium4.3Missing Authorization
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.29Update to 2.4.30
- Medium4.3Authenticated (Subscriber+) Information Exposure
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.29Update to 2.4.30
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
CF7 Mate – Contact Form 7 Styler, Multi-Step Forms & Conditional Logic
≤4.1.0Update to 4.1.1
- Medium5.3Unauthenticated Arbitrary Content Deletion
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
≤3.4.3Update to 3.5.0
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
SureDash – Community, Courses & Member Dashboard
≤1.12.3Update to 1.12.4
- Medium4.3Missing Authorization
Media Library Assistant
≤3.43Update to 3.44
- High8.8Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update
Ak Framework
≤2.9.8Update to 2.9.9
- High8.8Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.35Update to 7.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
Gravity Forms
≤3.1.1Update to 3.1.2
- Critical9.8Unauthenticated PHP Object Injection via Post Custom Field
Gravity Forms
≤3.1.2Update to 3.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via List Field
Gravity Forms
≤3.1.2Update to 3.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie
Food Store – Online Food Delivery & Pickup
≤1.5.5No patch available