Database
Critical WordPress vulnerabilities (page 1282)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.5 | Stored Cross-Site Scripting | CVE-2020-8799 | — | |
| Medium6.4 | Authenticated (Author+) Cross-Site Scripting via File Uploads WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11026 | — | |
| Medium6.1 | Password Reset Link Non-Expiration WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11027 | — | |
| Medium6.4 | Cross-Site Scripting in the Block Editor WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11030 | — | |
| Medium5.8 | Reflected Cross Site Scripting WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11029 | — | |
| Medium5.8 | Private Post Disclosure WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11028 | — | |
| Medium5.8 | Authenticated Cross-Site Scripting via Customizer WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11025 | — | |
| Medium6.1 | Cross-Site Request Forgery leading to Stored Cross-Site Scripting Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.4.24.2Update to 3.4.24.2 | CVE-2020-12462 | — | |
| High8.8 | SQL Injection | CVE-2020-12104 | — | |
| Medium4.3 | Redirect Security Bypass | CVE-2020-36699 | — | |
| High8.8 | Cross-Site Request Forgery to Stored Cross-Site Scripting | CVE-2020-13641 | — | |
| Medium6.4 | Authenticated (Contributor+) Cross-Site Scripting | CVE-2020-36711 | — | |
| Medium5.3 | Information Disclosure | CVE-2020-12070 | — | |
| High7.3 | Missing Authorization Checks | CVE-2020-36697 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2020-20628 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2020-12054 | — | |
| High7.3 | Missing Authorization | CVE-2020-36840 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2020-36703 | — | |
| High8.1 | Privilege Escalation via accept-to-be-teacher action parameter | CVE-2020-11511 | — | |
| Medium6.1 | Reflected Cross Site Scripting | CVE-2020-11930 | — | |
| High7.1 | Authenticated Page Creation and Status Modification | CVE-2020-11510 | — | |
| High7.4 | Unauthorized Widget Import to Stored Cross-Site Scripting | CVE-2020-36769 | — | |
| Critical9.8 | Missing Authorization | CVE-2020-11673 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-11727 | — | |
| High8.3 | Cross-Site Request Forgery | CVE-2020-36839 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2020-11508 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2020-11509 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2020-15535 | — | |
| Medium6.1 | Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting | CVE-2020-15537 | — | |
| High7.2 | Cross-Site Scripting | CVE-2020-15536 | — |
- Medium5.5Stored Cross-Site Scripting
WTI Like Post
<1.4.6Update to 1.4.6
- Medium6.4Authenticated (Author+) Cross-Site Scripting via File Uploads
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium6.1Password Reset Link Non-Expiration
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium6.4Cross-Site Scripting in the Block Editor
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium5.8Reflected Cross Site Scripting
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium5.8Private Post Disclosure
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium5.8Authenticated Cross-Site Scripting via Customizer
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium6.1Cross-Site Request Forgery leading to Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.24.2Update to 3.4.24.2
- High8.8SQL Injection
WordPress WP-Advanced-Search
≤3.3.6Update to 3.3.7
- Medium4.3Redirect Security Bypass
Quick Page/Post Redirect Plugin
≤5.1.9Update to 5.2.0
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Real-Time Find and Replace
≤3.9Update to 4.0.2
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
Avada | Website Builder For WordPress & WooCommerce
<6.2.3Update to 6.2.3
- Medium5.3Information Disclosure
Advanced Woo Search – Product Search for WooCommerce
≤1.99Update to 2.00
- High7.3Missing Authorization Checks
WP GDPR
≤2.1.1No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
WP GDPR
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Catch Breadcrumb
<1.5.5Update to 1.5.5
- High7.3Missing Authorization
Timetable and Event Schedule by MotoPress
≤2.3.8Update to 2.3.9
- Medium6.4Authenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.7Update to 2.9.8
- High8.1Privilege Escalation via accept-to-be-teacher action parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- Medium6.1Reflected Cross Site Scripting
Translate WordPress with GTranslate
≤2.8.51Update to 2.8.52
- High7.1Authenticated Page Creation and Status Modification
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- High7.4Unauthorized Widget Import to Stored Cross-Site Scripting
Widget Settings Importer/Exporter
≤1.5.3No patch available
- Critical9.8Missing Authorization
TS Poll – Survey, Versus Poll, Image Poll, Video Poll
<1.3.4Update to 1.3.4
- Medium6.1Cross-Site Scripting
Advanced Order Export For WooCommerce
<3.1.4Update to 3.1.4
- High8.3Cross-Site Request Forgery
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.99No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
<0.99Update to 0.99
- High7.2Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.98Update to 0.99
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Car Rental System
≤1.3No patch available
- Medium6.1Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting
Vanguard - Marketplace Digital Products PHP7
≤2.1No patch available
- High7.2Cross-Site Scripting
Online Hotel Booking System Pro
≤1.1No patch available