CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 81)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Additional Order Filters for WooCommerce
≤1.24No patch available
- High7.5Unauthenticated SQL Injection
Travel Booking WordPress Theme
≤3.2.9Update to 3.3
- Medium5.3Missing Authorization
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
≤4.1.12No patch available
- Medium5.31.19.8 - Missing Authorization
Shipping for Nova Poshta
1.18.7 – 1.19.8No patch available
- Medium5.3Missing Authorization
UnitechPay – Wave & Orange Money Payments
≤1.0.6.3No patch available
- Medium4.31.7.1 - Cross-Site Request Forgery
GDPR Data Request Form
1.5 – 1.7.1Update to 1.8
- High7.2Unauthenticated Stored Cross-Site Scripting
FV Player 8
≤8.1.8Update to 8.1.9
- Medium5.3Unauthenticated Information Exposure
Swish Migrate and Backup
≤1.4.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Share Icons & Social Share Buttons
≤3.7.5Update to 3.7.6
- Medium5.3Unauthenticated Information Exposure
Web Plura Backup & Restore – Local Backups, Restore & Recovery
≤0.2.25No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Jotform – AI Chatbot
≤3.8.3Update to 3.8.4
- Medium4.3Missing Authorization
Wordable – Export Google Docs to WordPress
≤8.2.10No patch available
- Medium4.3Missing Authorization
wpsection
≤1.5.1No patch available
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
AI Copilot – Content Generator
≤1.5.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
≤3.6.13Update to 3.6.14
- High7.3Unauthenticated Arbitrary Account Takeover
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
≤2.16.0Update to 2.17.0
- Medium5.3Unauthenticated Payment Bypass
Airwallex Online Payments Gateway
≤1.35.0Update to 1.36.0
- Medium6.1Reflected Cross-Site Scripting
Gloria Admin Panel
≤1.3No patch available
- Medium6.32.7.10 - Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
2.0.0 – 2.7.10Update to 2.8.0
- Medium4.3Missing Authorization
SendPress Newsletters
≤1.26.1.20No patch available
- High7.51.0.8 - Unauthenticated SQL Injection
Testimonials by BestWebSoft
1.0.5 – 1.0.8No patch available
- Medium5.3Missing Authorization
SKU Error Fixer for WooCommerce
≤1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤4.1.0Update to 4.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.5.54.7212Update to 7.5.55.7212
- High7.2Unauthenticated Stored Cross-Site Scripting
Qode Real Estate
≤1.1.7.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Qode Music
≤2.1.8.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder
≤2.17.0Update to 2.18.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)
≤1.5.3Update to 1.5.4
- Critical9.8Unauthenticated Remote Code Execution
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin
≤2.3.13Update to 2.3.14
- High8.1Unauthenticated PHP Object Injection
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
≤6.2.1Update to 6.2.2