Database
Critical WordPress vulnerabilities (page 1280)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium4.3 | Cross-Site Request Forgery Bypass | CVE-2021-4421 | — | |
| Critical9.8 | Real Estate WordPress Theme <= 1.7 - SQL Injection | CVE-2020-15363 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2020-26672 | — | |
| Medium6.1 | Real Estate WordPress Theme < 1.8 - Cross-Site Scripting | CVE-2020-15364 | — | |
| Medium6.5 | All Comments Deletion via Cross-Site Request Forgery | CVE-2020-36505 | — | |
| High8.8 | Arbitrary File Upload | CVE-2020-36701 | — | |
| High8.8 | Authorization Bypass due to Improper Access Control | CVE-2020-36700 | — | |
| Critical9.8 | wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter | CVE-2020-13640 | — | |
| Medium5.3 | Comment Disclosure WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-25286 | — | |
| Low3.5 | Arbitrary User Meta Update WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4050 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-36172 | — | |
| Low2.4 | Self-Cross Site Scripting via Theme Folder Name WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4049 | — | |
| Medium6.8 | Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4047 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4046 | — | |
| Medium5.7 | Open Redirect WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4048 | — | |
| High7.2 | Admin+ SQL Injection | CVE-2020-35012 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-35037 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2020-13892 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-13864 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-13865 | — | |
| Critical9.8 | Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload | CVE-2020-12800 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2021-24138 | — | |
| High7.4 | Authorization Bypass to Settings Updates | CVE-2020-36714 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2022-1169 | — | |
| High7.1 | Reflected Cross-Site Scripting | CVE-2022-1168 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2019-20182 | — | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload | CVE-2022-1939 | — | |
| High7.3 | Authenticated CSV Injection | CVE-2020-36503 | — | |
| High7.5 | Insecure direct object reference via permalinks manipulation | CVE-2020-13700 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2021-24137 | — |
- Medium4.3Cross-Site Request Forgery Bypass
Advanced Popups
≤1.1.1Update to 1.1.2
- Critical9.8Real Estate WordPress Theme <= 1.7 - SQL Injection
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Medium6.4Authenticated Stored Cross-Site Scripting
Testimonial Rotator
<3.0.3No patch available
- Medium6.1Real Estate WordPress Theme < 1.8 - Cross-Site Scripting
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Medium6.5All Comments Deletion via Cross-Site Request Forgery
Delete All Comments Easily
≤1.3No patch available
- High8.8Arbitrary File Upload
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4
- High8.8Authorization Bypass due to Improper Access Control
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4
- Critical9.8wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter
Comments – wpDiscuz
<5.3.6Update to 5.3.6
- Medium5.3Comment Disclosure
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Low3.5Arbitrary User Meta Update
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium6.1Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.8.12Update to 5.8.12
- Low2.4Self-Cross Site Scripting via Theme Folder Name
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium6.8Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium5.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium5.7Open Redirect
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- High7.2Admin+ SQL Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
- Medium5.4Cross-Site Scripting
SportsPress – Sports Club & League Manager
<2.7.2Update to 2.7.2
- Medium5.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9
- Medium5.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9
- Critical9.8Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.3.2Update to 1.3.3.3
- High7.2Authenticated SQL Injection
AdRotate Banner Manager
<5.8.4Update to 5.8.4
- High7.4Authorization Bypass to Settings Updates
Brizy – Page Builder
<1.0.126Update to 1.0.126
- Medium6.1Cross-Site Scripting
Careerfy - Job Board WordPress Theme
<3.9.0Update to 3.9.0
- High7.1Reflected Cross-Site Scripting
JobSearch WP Job Board
<1.5.1Update to 1.5.1
- Medium4.8Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤1.8.12Update to 1.8.18
- High7.2Authenticated (Admin+) Arbitrary File Upload
Allow svg files
<1.1Update to 1.1
- High7.3Authenticated CSV Injection
Connections Business Directory
≤9.6Update to 9.7
- High7.5Insecure direct object reference via permalinks manipulation
ACF to REST API
≤3.2.0Update to 3.3.0
- High8.8Authenticated SQL Injection
Blog2Social: Social Media Auto Post & Scheduler
≤6.3.0Update to 6.3.1