Database
Critical WordPress vulnerabilities (page 1290)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting via custom-write-panel-id Parameter | CVE-2017-18609 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2019-12516 | — | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting | CVE-2019-25315 | — | |
| Medium6.1 | Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-group-id parameter | CVE-2017-18610 | — | |
| Critical9.8 | Stored Cross-Site Scripting via Import | CVE-2019-15896 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Read | CVE-2019-25213 | — | |
| Critical9.8 | SQL Injection | CVE-2019-16119 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16118 | — | |
| Critical9.8 | Real Estate Directory <= 1.1 - SQL Injection | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16117 | — | |
| High7.5 | Arbitrary Settings Change | CVE-2019-15895 | — | |
| Medium5.4 | Reflected Cross-Site Scripting via Shortcode Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16219 | — | |
| High7.2 | Stored Cross-Site Scripting via Comments WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16218 | — | |
| Medium4.6 | Open Redirect WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16220 | — | |
| Medium6.4 | Cross-Site Scripting via Media Uploads WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16217 | — | |
| Medium6.4 | Stored Cross-Site Scripting via Comments via URLs WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16222 | — | |
| Medium6.1 | Reflected Cross-Site Scripting WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16221 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16332 | — | |
| Medium5.4 | Authenticated Cross-Site Scripting via Post Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16223 | — | |
| High8.8 | CSV Injection | CVE-2019-16120 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-1010124 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2019-15777 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15769 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14314 | 300K+ | |
| High7.5 | Unauthenticated Settings Change | CVE-2019-15816 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9352 | — | |
| Medium5.3 | Improper Input Validation | CVE-2019-14978 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-14470 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15770 | — | |
| High7.5 | Missing Authorization to Settings Update | CVE-2019-15821 | — |
- Medium6.1Cross-Site Scripting via custom-write-panel-id Parameter
Magic Fields
≤1.7.1Update to 1.7.2
- High8.8Authenticated SQL Injection
SlickQuiz
≤1.3.7.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Server Log Viewer
≤1.0No patch available
- Medium6.1Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-group-id parameter
Magic Fields
≤1.7.1Update to 1.7.2
- Critical9.8Stored Cross-Site Scripting via Import
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<3.35.0Update to 3.35.0
- Critical9.8Unauthenticated Arbitrary File Read
Access Governance for WordPress (aka AAM)
<5.9.9Update to 5.9.9
- Critical9.8SQL Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.35Update to 1.5.35
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.34Update to 1.5.35
- Critical9.8Real Estate Directory <= 1.1 - SQL Injection
Selio
≤1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.35Update to 1.5.35
- High7.5Arbitrary Settings Change
Search Exclude
<1.2.4Update to 1.2.4
- Medium5.4Reflected Cross-Site Scripting via Shortcode Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- High7.2Stored Cross-Site Scripting via Comments
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium4.6Open Redirect
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.4Cross-Site Scripting via Media Uploads
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.4Stored Cross-Site Scripting via Comments via URLs
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.1Reflected Cross-Site Scripting
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.1Cross-Site Scripting
API Bearer Auth
<20190907Update to 20190907
- Medium5.4Authenticated Cross-Site Scripting via Post Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- High8.8CSV Injection
Event Tickets and Registration
≤4.10.7.1Update to 4.10.7.2
- Medium6.1Reflected Cross-Site Scripting
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤3.1.14Update to 3.1.15
- Medium5.4Cross-Site Scripting
WP DSGVO Tools (GDPR)
<2.2.19Update to 2.2.19
- High8.8Cross-Site Request Forgery
HandL UTM Grabber / Tracker
<2.6.5Update to 2.6.5
- Critical9.8SQL Injection
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<3.2.11Update to 3.2.11
- High7.5Unauthenticated Settings Change
WP Private Content Plus
≤1.31Update to 2.0
- Critical9.8SQL Injection
WP-Polls
≤2.71Update to 2.72
- Medium5.3Improper Input Validation
WooCommerce PayU India (PayUmoney – PayUbiz)
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
UserPro - Community and User Profile WordPress Plugin
≤4.9.34Update to 4.9.35.1
- High8.8Cross-Site Request Forgery
Address Book for WooCommerce
<1.6.0Update to 1.6.0
- High7.5Missing Authorization to Settings Update
Bold Page Builder
≤2.3.1Update to 2.3.2