CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 9)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
- Medium4.3Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.4.12Update to 4.4.13
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Site Reviews
≤8.3.6Update to 8.3.7
- Medium5.3Missing Authorization
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤5.3.1Update to 5.3.2
- Medium5.3Missing Authorization
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
≤2.6.1Update to 2.6.2
- Medium4.3Missing Authorization
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution
≤2.5.0Update to 2.6.0
- Medium6.1Reflected Cross-Site Scripting
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO
≤3.1.4Update to 3.1.5
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.71Update to 3.1.72
- High7.2Unauthenticated Stored Cross-Site Scripting
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
JetFormBuilder — Dynamic Blocks Form Builder
≤3.6.8Update to 3.6.8.1
- Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.7Update to 4.18.0
- Medium4.3Cross-Site Request Forgery
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Invoice Gateway for WooCommerce – Invoice Payment Gateway
≤1.1.6Update to 1.1.7
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤3.3.6Update to 3.3.7
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Customize WordPress Emails and Alerts – Better Notifications for WP
≤1.10.1Update to 1.10.2
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Welcart e-Commerce
≤2.12.6Update to 2.12.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤4.3.5Update to 4.3.6
- High7.3Unauthenticated Arbitrary Shortcode Execution
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.17.7Update to 4.18.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
≤3.21.2Update to 4.0.0
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
The Events Calendar
≤6.18.3Update to 6.18.3.1
- Medium5.3Unauthenticated Insecure Direct Object Reference
JetFormBuilder – Hierarchical Select
≤1.0.10Update to 1.0.11
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Cool FormKit Lite – Advanced Form Builder for Elementor
≤2.7.10Update to 2.7.11
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
Active Woot Products Tables for WooCommerce. 100% FREE
≤2.1.6Update to 2.1.7
- Medium5.3Unauthenticated CAPTCHA Protection Bypass on Login
Simple CAPTCHA with Cloudflare Turnstile
≤1.44.4Update to 1.44.5
- Medium5.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.2.20Update to 2.2.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Post Fields for Contact Form 7
≤2.6.0Update to 2.7.1
- Medium4.3Missing Authorization
PowerPress Podcasting plugin by Blubrry
≤11.18.0Update to 11.18.2
- High7.2Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]
Download Manager
6.0.0 – 7.5.9Update to 7.6.4
- Critical9.1Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action
Checkout Field Editor for WooCommerce (Pro)
≤3.8.0Update to 3.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Quttera ThreatSign – Web Malware Scanner for WordPress
≤4.1.0.48Update to 4.1.0.49