CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 83)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Video Background Block – Add Stunning Video Backgrounds to Any Section
≤2.0.3Update to 2.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
≤4.4.6Update to 4.4.7
- Medium5.3Missing Authorization
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.7.1Update to 3.7.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Social Rocket – Social Sharing Plugin
≤1.3.5Update to 1.3.6
- High7.5Unauthenticated SQL Injection
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤7.9.0Update to 7.9.1
- Medium6.5Authenticated (Subscriber+) SQL Injection
uDesign | Multipurpose WordPress Theme
≤4.15.0No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
ListingPro Plugin
≤2.9.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Blog, Posts and Category Filter for Elementor
≤2.1.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
CF7 Views – Complete Entry Management for Contact Form 7
≤3.2.6No patch available
- High7.5Unauthenticated SQL Injection
Newsletter Subscription Form – User Subscriptions Form, Capture Email
≤1.5.9No patch available
- Medium5.3Unauthenticated Information Exposure
SafeSnap – Verified WordPress Backup & Restore
≤2.1.2No patch available
- Medium5.3Missing Authorization
WXD Backup Lite
≤1.0.2No patch available
- Medium5.3Unauthenticated Information Exposure
Museder RestoreOne
≤2.7.277Update to 2.7.278
- Medium5.3Unauthenticated Information Exposure
Norvis Backup
≤1.1.0No patch available
- Medium5.3Unauthenticated Information Exposure
Sitemovr
≤1.0.1No patch available
- Medium5.3Unauthenticated Information Exposure
Snapshotify – All-in-One Backup & Restore & Migrate
≤1.3.6Update to 1.3.7
- Medium5.3Missing Authorization
Fluent Booking Pro
<2.5.0Update to 2.5.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden
≤3.5.7No patch available
- Medium4.3Missing Authorization
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden
≤3.5.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce
≤2.0.6Update to 2.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
≤5.5No patch available
- High7.3Unauthenticated Privilege Escalation
Meta Box AIO
≤3.7.1No patch available
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- Medium5.3Missing Authorization
Kit (formerly ConvertKit) for WooCommerce
≤2.2.0Update to 2.2.1
- Medium5.3Missing Authorization
Morning for WooCommerce
≤2.4.1Update to 2.4.2
- High7.2Unauthenticated Stored Cross-Site Scripting
HTTP Requests Manager
≤1.3.11Update to 1.3.12
- High7.2Unauthenticated Stored Cross-Site Scripting
Database for CF7
≤1.2.6No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WC Fields Factory
≤4.1.12No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Designer for WooCommerce WordPress | Lumise
≤2.1.1No patch available
- High7.2Unauthenticated Server-Side Request Forgery
Instapage Plugin
≤3.7.2Update to 3.7.3