CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 34)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via 'l10n_print_after' Parameter
Webheadcoder Multi-Step Forms for Contact Form 7
≤4.7Update to 4.7.1
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
CMB2
≤2.13.4Update to 2.13.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
≤4.7.2Update to 4.7.3
- Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.4.1Update to 6.4.2
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink
Postie
≤1.9.87Update to 1.9.88
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute
If-So Dynamic Content – Elementor & All Page Builders Personalization
≤1.10.2Update to 1.10.3
- High8.8Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
VikRentCar Car Rental Management System
≤1.4.8Update to 1.4.9
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action
AI ChatBot for WooCommerce – WoowBot
≤5.0.0Update to 5.0.1
- High8.8Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload
The Innovative Form Builder – IvyForms
≤1.5.1Update to 1.5.2
- Medium6.5Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute
WP Inventory Manager
≤2.5.5Update to 2.5.6
- Medium6.3Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation
BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility
≤1.3.6Update to 1.3.7
- Medium5.3Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action
PayPal Brasil para WooCommerce
≤1.7.8Update to 1.7.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute
VikRentCar Car Rental Management System
≤1.4.10Update to 1.4.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.3Update to 7.8.14.4
- Medium6.5Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute
VikRentCar Car Rental Management System
≤1.4.10Update to 1.4.11
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter
Related Posts for WordPress
≤3.0.0Update to 3.0.1
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.8.14.3Update to 7.8.14.4
- Medium4.3Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
Related Posts for WordPress
≤3.0.0Update to 3.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
Avada (Fusion) Builder
≤3.16.2Update to 3.16.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
≤2.2.27Update to 2.2.28
- Medium5.9Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More
≤1.31.0Update to 1.32.0
- Medium6.5Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute
WP Visitor Statistics (Real Time Traffic)
≤8.8Update to 8.9
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter
Product Addons for Woocommerce – Product Options with Custom Fields
≤3.1.8Update to 3.1.9
- Medium6.5Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page
Rich Showcase for Google Reviews
≤7.1.6Update to 7.1.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
Waitlist Woocommerce ( Back in stock notifier )
≤2.9.1Update to 2.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.6Update to 2.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL
UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks
≤5.3.0Update to 5.4.0
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
Travelly – Tour & Travel Booking Manager for WooCommerce
≤2.3.6Update to 2.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
≤261011Update to 261017
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.2.4Update to 4.2.5