Database
Critical WordPress vulnerabilities (page 1275)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.4 | Arbitrary File Deletion WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28039 | — | |
| High8.8 | Privilege Escalation via XML-RPC WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28035 | — | |
| Medium4.3 | Spam Embed on Multisite Installations WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28033 | — | |
| Medium6.4 | Stored Cross-Site Scripting via post slugs WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28038 | — | |
| Medium4.3 | Cross-Site Request Forgery to Theme Image Change WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28040 | — | |
| Medium4.8 | Misconfiguration That Allows Trigger of New Installation WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28037 | — | |
| High8.8 | Privilege Escalation via XML-RPC WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28036 | — | |
| Medium6.1 | Reflected Cross-Site Scripting via Global Variables WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28034 | — | |
| Critical9.8 | PHP Object Injection Gadget WordPress<5.5.3Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.8 or 5.2.9 or 5.3.6 or 5.4.4 or 5.5.3 | CVE-2021-29476 | — | |
| High8.8 | Deserialization Gadget WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28032 | — | |
| Critical9.8 | Unauthenticated SQL Injection | — | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2020-27344 | — | |
| Critical9.8 | SQL Injection | CVE-2020-27615 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2020-5650 | — | |
| High8.8 | SQL Injection | CVE-2020-5651 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-27356 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2020-28707 | — | |
| High8.8 | Arbitrary Options Update | CVE-2020-36725 | — | |
| Critical9.1 | Arbitrary Post Deletion | — | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2020-5642 | — | |
| High8.8 | Cross-Site Request Forgery to Arbitrary File Modification and Creation | CVE-2020-28649 | — | |
| High7.1 | Incorrect Authorization Checks Allowing Post Modification | CVE-2021-38345 | — | |
| High7.2 | Arbitrary File Upload | CVE-2021-24123 | — | |
| Medium4.8 | Unsafe File Upload to Cross-Site Scripting | CVE-2021-24378 | — | |
| High8.1 | Race Condition leading to Remote Code Execution | CVE-2021-24377 | — | |
| Critical9.8 | Arbitrary File Upload (and Remote Code Execution) via Import Settings | CVE-2021-24376 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting | CVE-2020-28650 | — | |
| High7.2 | Authenticated Remote Code Execution in Dynamic OOO Widget | CVE-2020-26596 | — | |
| Critical9.1 | Authentication Bypass | CVE-2020-26511 | — | |
| Critical9.8 | Function Injection | CVE-2020-36708 | — |
- Medium5.4Arbitrary File Deletion
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- High8.8Privilege Escalation via XML-RPC
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium4.3Spam Embed on Multisite Installations
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium6.4Stored Cross-Site Scripting via post slugs
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium4.3Cross-Site Request Forgery to Theme Image Change
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium4.8Misconfiguration That Allows Trigger of New Installation
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- High8.8Privilege Escalation via XML-RPC
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium6.1Reflected Cross-Site Scripting via Global Variables
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Critical9.8PHP Object Injection Gadget
WordPress
<5.5.3Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.8 or 5.2.9 or 5.3.6 or 5.4.4 or 5.5.3
- High8.8Deserialization Gadget
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Critical9.8Unauthenticated SQL Injection
Advanced Booking Calendar
<1.6.2Update to 1.6.2
- Medium5.5Authenticated Stored Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- Critical9.8SQL Injection
Loginizer
<1.6.4Update to 1.6.4
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Simple Download Monitor
≤3.3.8Update to 3.3.9
- High8.8SQL Injection
Simple Download Monitor
≤3.8.8Update to 3.8.9
- Medium5.4Stored Cross-Site Scripting
Debug Meta Data
≤1.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Stockdio Historical Chart
<2.8.1Update to 2.8.1
- High8.8Arbitrary Options Update
TI WooCommerce Wishlist
≤1.21.11Update to 1.21.12
- Critical9.1Arbitrary Post Deletion
Realia
≤1.4.0No patch available
- High8.8Cross-Site Request Forgery
AI Chatbot for WooCommerce & Live Chat – onWebChat
≤3.1.0Update to 3.2.0
- High8.8Cross-Site Request Forgery to Arbitrary File Modification and Creation
Child Theme Creator by Orbisius
<1.5.2Update to 1.5.2
- High7.1Incorrect Authorization Checks Allowing Post Modification
Brizy – Page Builder
≤2.3.11Update to 1.0.126 or 2.3.12
- High7.2Arbitrary File Upload
PowerPress Podcasting plugin by Blubrry
≤8.3.7Update to 8.3.8
- Medium4.8Unsafe File Upload to Cross-Site Scripting
Autoptimize
<2.7.8Update to 2.7.8
- High8.1Race Condition leading to Remote Code Execution
Autoptimize
<2.7.8Update to 2.7.8
- Critical9.8Arbitrary File Upload (and Remote Code Execution) via Import Settings
Autoptimize
<2.7.8Update to 2.7.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPBakery Page Builder
≤6.4Update to 6.4.1
- High7.2Authenticated Remote Code Execution in Dynamic OOO Widget
Elementor Website Builder Pro
≤3.0.5Update to 3.0.6
- Critical9.1Authentication Bypass
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤11.6Update to 11.7
- Critical9.8Function Injection
Sparkling
≤2.4.8Update to 2.4.9