VulnCrest
Search
Create account
Report an incident
Radar sectionsCritical
Check my site

Database

Critical WordPress vulnerabilities (page 1288)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

Signals
Software

41,567 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1288)
SeverityVulnerabilityCVEInstallsPublished
High8.8Cross-Site Request Forgery
IgniteUp – Coming Soon and Maintenance Mode≤3.4.0Update to 3.4.1
CVE-2019-17237—
High7.5Unauthenticated Arbitrary File Deletion
IgniteUp – Coming Soon and Maintenance Mode<3.4.1Update to 3.4.1
CVE-2019-17234—
Medium5.3Information Disclosure
IgniteUp – Coming Soon and Maintenance Mode≤3.4.0Update to 3.4.1
CVE-2019-17235—
Medium5.4Arbitrary Plugin Activation
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce≤1.3.0Update to 1.3.1
CVE-2019-25151—
Medium6.5Denial of Service
Safe SVG≤1.9.4Update to 1.9.5
CVE-2019-18855—
Medium6.5Denial of Service
Safe SVG≤1.9.4Update to 1.9.5
CVE-2019-18854—
Medium6.5Authorization Bypass
Currency Switcher for WooCommerce<2.11.2Update to 2.11.2
CVE-2019-18668—
Medium4.3Authenticated Settings Change
YITH WooCommerce Wishlist≤2.2.13Update to 2.2.14
CVE-2019-16251—
Medium5.3Missing Authorization to Settings Update
GiveWP – Donation Plugin and Fundraising Platform<2.5.10Update to 2.5.10
CVE-2020-20627—
Medium4.4Authenticated (Subscriber+) CSV Injection
Admin Columns Pro≤6.4.9Update to 6.4.10
CVE-2019-17661—
High8.8Arbitrary File Upload
Elementor Website Builder – more than just a page builder<2.7.5Update to 2.7.5
CVE-2020-7055—
High8.8HTML Injection
Email Templates Customizer and Designer for WordPress and WooCommerce≤1.3Update to 1.3.1
CVE-2019-25150—
Medium5.4HTML injection
WP Email Template<2.2.11Update to 2.2.11
CVE-2019-25144—
Medium6.1HTML Injection
Email Template Designer – WP HTML Mail<2.9.1Update to 2.9.1
CVE-2019-25148—
Medium6.1Reflected Cross-Site Scripting
Noo JobMonster<4.5.2.9Update to 4.5.2.9
CVE-2022-1170—
High7.5Authenticated SQL Injection
Sliced Invoices – WordPress Invoice Plugin<3.8.4Update to 3.8.4
CVE-2020-20625—
Medium6.4Authenticated Stored Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!≤5.9.5Update to 5.9.6
CVE-2019-16523—
Medium6.1Cross-Site Scripting
wpDataTables (Premium)≤2.0.11Update to 2.0.12
CVE-2019-6011—
High7.2SQL injection
wpDataTables (Premium)≤2.0.11Update to 2.0.12
CVE-2019-6012—
Medium4.3Full Path Disclosure
Fast Velocity Minify≤2.7.6Update to 2.7.7
CVE-2019-19983—
Medium6.4Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)≤3.2.6Update to 3.2.7
CVE-2019-16520—
Medium5.5Authenticated Stored Cross-Site Scripting
EU Cookie Law for GDPR/CCPA<3.1.3Update to 3.1.3
CVE-2019-16522—
Medium6.1Reflected Cross-Site Scripting
Zoho CRM Lead Magnet<1.6.9.2Update to 1.6.9.2
CVE-2019-19306—
Medium6.1Reflected Cross-Site Scripting
Broken Link Checker<1.11.9Update to 1.11.9
CVE-2019-16521—
Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – Commissions≤3.1.2Update to 3.1.3
CVE-2015-9508—
Medium5.4Server Side Request Forgery #2
WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
CVE-2019-17670—
Medium5.4Server Side Request Forgery
WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
CVE-2019-17669—
Medium5.5Type Confusion
WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
CVE-2019-17675—
Medium6.4Authenticated Stored Cross-Site Scripting
WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
CVE-2019-17672—
High7.3Cache Poisoning
WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
CVE-2019-17673—
  • High8.8
    Cross-Site Request Forgery

    IgniteUp – Coming Soon and Maintenance Mode

    ≤3.4.0Update to 3.4.1

    CVE-2019-17237

  • High7.5
    Unauthenticated Arbitrary File Deletion

    IgniteUp – Coming Soon and Maintenance Mode

    <3.4.1Update to 3.4.1

    CVE-2019-17234

  • Medium5.3
    Information Disclosure

    IgniteUp – Coming Soon and Maintenance Mode

    ≤3.4.0Update to 3.4.1

    CVE-2019-17235

  • Medium5.4
    Arbitrary Plugin Activation

    CartFlows – Funnel Builder & Checkout Plugin for WooCommerce

    ≤1.3.0Update to 1.3.1

    CVE-2019-25151

  • Medium6.5
    Denial of Service

    Safe SVG

    ≤1.9.4Update to 1.9.5

    CVE-2019-18855

  • Medium6.5
    Denial of Service

    Safe SVG

    ≤1.9.4Update to 1.9.5

    CVE-2019-18854

  • Medium6.5
    Authorization Bypass

    Currency Switcher for WooCommerce

    <2.11.2Update to 2.11.2

    CVE-2019-18668

  • Medium4.3
    Authenticated Settings Change

    YITH WooCommerce Wishlist

    ≤2.2.13Update to 2.2.14

    CVE-2019-16251

  • Medium5.3
    Missing Authorization to Settings Update

    GiveWP – Donation Plugin and Fundraising Platform

    <2.5.10Update to 2.5.10

    CVE-2020-20627

  • Medium4.4
    Authenticated (Subscriber+) CSV Injection

    Admin Columns Pro

    ≤6.4.9Update to 6.4.10

    CVE-2019-17661

  • High8.8
    Arbitrary File Upload

    Elementor Website Builder – more than just a page builder

    <2.7.5Update to 2.7.5

    CVE-2020-7055

  • High8.8
    HTML Injection

    Email Templates Customizer and Designer for WordPress and WooCommerce

    ≤1.3Update to 1.3.1

    CVE-2019-25150

  • Medium5.4
    HTML injection

    WP Email Template

    <2.2.11Update to 2.2.11

    CVE-2019-25144

  • Medium6.1
    HTML Injection

    Email Template Designer – WP HTML Mail

    <2.9.1Update to 2.9.1

    CVE-2019-25148

  • Medium6.1
    Reflected Cross-Site Scripting

    Noo JobMonster

    <4.5.2.9Update to 4.5.2.9

    CVE-2022-1170

  • High7.5
    Authenticated SQL Injection

    Sliced Invoices – WordPress Invoice Plugin

    <3.8.4Update to 3.8.4

    CVE-2020-20625

  • Medium6.4
    Authenticated Stored Cross-Site Scripting

    Events Manager – Calendar, Bookings, Tickets, Appointments and more!

    ≤5.9.5Update to 5.9.6

    CVE-2019-16523

  • Medium6.1
    Cross-Site Scripting

    wpDataTables (Premium)

    ≤2.0.11Update to 2.0.12

    CVE-2019-6011

  • High7.2
    SQL injection

    wpDataTables (Premium)

    ≤2.0.11Update to 2.0.12

    CVE-2019-6012

  • Medium4.3
    Full Path Disclosure

    Fast Velocity Minify

    ≤2.7.6Update to 2.7.7

    CVE-2019-19983

  • Medium6.4
    Stored Cross-Site Scripting

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    ≤3.2.6Update to 3.2.7

    CVE-2019-16520

  • Medium5.5
    Authenticated Stored Cross-Site Scripting

    EU Cookie Law for GDPR/CCPA

    <3.1.3Update to 3.1.3

    CVE-2019-16522

  • Medium6.1
    Reflected Cross-Site Scripting

    Zoho CRM Lead Magnet

    <1.6.9.2Update to 1.6.9.2

    CVE-2019-19306

  • Medium6.1
    Reflected Cross-Site Scripting

    Broken Link Checker

    <1.11.9Update to 1.11.9

    CVE-2019-16521

  • Medium6.1
    Reflected Cross-Site Scripting

    Easy Digital Downloads – Commissions

    ≤3.1.2Update to 3.1.3

    CVE-2015-9508

  • Medium5.4
    Server Side Request Forgery #2

    WordPress

    ≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4

    CVE-2019-17670

  • Medium5.4
    Server Side Request Forgery

    WordPress

    ≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4

    CVE-2019-17669

  • Medium5.5
    Type Confusion

    WordPress

    ≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4

    CVE-2019-17675

  • Medium6.4
    Authenticated Stored Cross-Site Scripting

    WordPress

    ≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4

    CVE-2019-17672

  • High7.3
    Cache Poisoning

    WordPress

    ≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4

    CVE-2019-17673

Search VulnCrest Radar

Jump to

Are you sure?