CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 84)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Information Exposure
Edwiser Bridge – WordPress Moodle Integration
≤4.3.4No patch available
- Medium4.3Missing Authorization
Wise Chat
≤3.4.3Update to 3.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.7.6No patch available
- High7.5Unauthenticated SQL Injection
Booknetic
≤4.8.5No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Woffice CRM
≤5.4.35No patch available
- Medium4.3Missing Authorization
App for Cloudflare®
≤1.10.1No patch available
- Medium5.3Missing Authorization
PayPlug for WooCommerce (Official)
≤3.1.0Update to 3.1.1
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
Piotnet Addons For Elementor
≤7.1.71No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Appointment Bookings for Zoom GoogleMeet and more – Wappointment
≤2.7.7No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
WP Duplicate – WordPress Migration Plugin
≤1.1.11No patch available
- High7.3Unauthenticated Privilege Escalation
Taskbot
≤6.6No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Taskbot
≤6.6No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Midtrans-WooCommerce
≤2.32.3No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Mapster WP Maps
≤2.0.4Update to 2.0.5
- Medium4.3Authenticated (Contributor+) Information Exposure
Polylang
≤3.8.7Update to 3.8.8
- Medium5.3Missing Authorization
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- Medium5.3Unauthenticated Information Exposure
Groundhogg — CRM, Newsletters, and Marketing Automation
≤4.8.3Update to 4.9
- Medium5.3Unauthenticated Information Exposure
XServer Migrator
≤1.6.6Update to 1.6.7
- Medium5.3Unauthenticated Information Exposure
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
≤4.1.25Update to 4.1.26
- High7.3Unauthenticated Privilege Escalation
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤4.0.0Update to 4.0.1
- Medium5.3Unauthenticated Information Exposure
Motors – Car Dealership & Classified Listings Plugin
≤1.4.124Update to 1.4.125
- High7.2Unauthenticated Stored Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.8.12.3Update to 1.8.13
- High7.2Unauthenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- High7.2Unauthenticated Stored Cross-Site Scripting
picu – Online Photo Proofing Gallery
≤3.10.1Update to 3.10.2
- Medium5.3Missing Authorization
picu – Online Photo Proofing Gallery
≤3.10.1Update to 3.10.2
- High7.3Unauthenticated Privilege Escalation
GiveWP – Donation Plugin and Fundraising Platform
≤4.17.0Update to 4.18.0
- Medium6.5Authenticated (Subscriber+) SQL Injection
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.1.1Update to 3.1.2
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
WP User Profiles
≤2.7.3Update to 2.7.4
- Medium5.3Missing Authorization
PowerPress Podcasting plugin by Blubrry
≤11.17.9Update to 11.17.11
- Medium4.3Missing Authorization
WP Dummy Content Generator
≤4.0.0No patch available