Database
Critical WordPress vulnerabilities (page 1289)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-20626 | — | |
| Medium5.3 | Authorization Bypass WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17671 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting via Customizer WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17674 | — | |
| High7.5 | Unauthenticated information disclosure | CVE-2019-17574 | — | |
| Medium5.4 | Reflected Cross-Site Scripting | CVE-2019-17207 | — | |
| High7.5 | Unauthenticated Arbitrary File Deletion | CVE-2019-16902 | — | |
| Medium5.5 | Authenticated (Admin+) Cross-Site Scripting | CVE-2019-17071 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-17070 | — | |
| High8.0 | Authenticated (Admin+) SQL Injection | CVE-2019-17072 | — | |
| Critical9.8 | Authentication Bypass | — | — | |
| High7.2 | Missing Authorization to Stored Cross-Site Scripting | CVE-2019-25214 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2019-17239 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2017-14760 | — | |
| Critical9.3 | Server-Side Request Forgery | CVE-2019-16932 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-16931 | — | |
| High7.5 | Authorization Bypass | CVE-2019-20360 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2019-16524 | — | |
| Medium6.1 | Real Estate WordPress Theme < 4.2 - Cross-Site Scripting | CVE-2019-25742 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2019-25216 | — | |
| High7.2 | Stored Cross Site Scripting | CVE-2019-25146 | — | |
| Critical9.1 | Unauthenticated Options Import/Export | CVE-2019-17232 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-17229 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-17233 | — | |
| Medium6.5 | Unauthenticated Settings Import/Export | CVE-2019-17228 | — | |
| High7.4 | CSV Injection | CVE-2020-9466 | — | |
| Medium6.4 | Authenticated Cross-Site Scripting | CVE-2019-16289 | — | |
| Medium5.3 | Information Disclosure | CVE-2019-14936 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-12517 | — | |
| Medium6.1 | Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-field-css parameter | CVE-2017-18611 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16525 | — |
- Medium5.4Stored Cross-Site Scripting
Lara's Google Analytics (GA4)
<2.0.5Update to 2.0.5
- Medium5.3Authorization Bypass
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.5Authenticated Stored Cross-Site Scripting via Customizer
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- High7.5Unauthenticated information disclosure
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.8.12Update to 1.8.13
- Medium5.4Reflected Cross-Site Scripting
Broken Link Checker
<1.11.9Update to 1.11.9
- High7.5Unauthenticated Arbitrary File Deletion
ARforms
≤3.7.1Update to 4.0
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Client Dash
≤2.2.0No patch available
- Medium6.1Cross-Site Scripting
LIQUID SPEECH BALLOON
<1.0.7Update to 1.0.7
- High8.0Authenticated (Admin+) SQL Injection
Contact Form Widget – Responsive Contact Form, Query Form & Form Builder
≤1.3.8Update to 1.3.9
- Critical9.8Authentication Bypass
Kadence Central – Site Management, Backups, Security, and Reporting
<2.0.18Update to 2.0.18
- High7.2Missing Authorization to Stored Cross-Site Scripting
ShopWP
≤2.0.4Update to 2.0.5
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Download Plugins and Themes in ZIP from Dashboard
<1.6.0Update to 1.6.0
- Critical9.8Unauthenticated SQL Injection
Event Expresso Free
≤3.1.37.12Update to 3.1.37.14 or 3.1.37.14L
- Critical9.3Server-Side Request Forgery
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.3.0Update to 3.3.1
- Medium6.1Stored Cross-Site Scripting
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.3.0Update to 3.3.1
- High7.5Authorization Bypass
GiveWP – Donation Plugin and Fundraising Platform
≤2.5.4Update to 2.5.5
- Medium5.5Authenticated Stored Cross-Site Scripting
Firelight Lightbox
≤1.8.17Update to 1.8.18
- Medium6.1Real Estate WordPress Theme < 4.2 - Cross-Site Scripting
Zoner - Real Estate WordPress Theme
<4.2Update to 4.2
- High7.2Stored Cross-Site Scripting
Rich Reviews by Starfish
≤1.7.4Update to 1.8.0
- High7.2Stored Cross Site Scripting
DELUCKS SEO
≤2.1.7Update to 2.1.8
- Critical9.1Unauthenticated Options Import/Export
Ultimate FAQ Accordion Plugin
<1.8.25Update to 1.8.25
- Medium6.1Stored Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
<1.4.1Update to 1.4.1
- Medium6.1Cross-Site Scripting
Ultimate FAQ Accordion Plugin
<1.8.25Update to 1.8.25
- Medium6.5Unauthenticated Settings Import/Export
Motors – Car Dealership & Classified Listings Plugin
<1.4.1Update to 1.4.1
- High7.4CSV Injection
Export Users to CSV
<1.4Update to 1.4
- Medium6.4Authenticated Cross-Site Scripting
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
<2.2.9Update to 2.2.9
- Medium5.3Information Disclosure
Easy!Appointments
≤1.3.2Update to 1.4.0
- Medium6.1Stored Cross-Site Scripting
SlickQuiz
≤1.3.7.1No patch available
- Medium6.1Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-field-css parameter
Magic Fields
≤1.7.1Update to 1.7.2
- Medium6.1Cross-Site Scripting
Checklist
≤1.1.8Update to 1.1.9