VulnCrest
Search
Create account
Report an incident
Radar sectionsCritical
Check my site

Database

Critical WordPress vulnerabilities (page 1296)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

Signals
Software

41,567 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1296)
SeverityVulnerabilityCVEInstallsPublished
High7.5Arbitrary File Download
Simple File List≤3.2.7Update to 3.2.8
CVE-2022-1119—
Critical9.8Cross-Site Request Forgery
WP Booking System – Booking Calendar<1.5.2Update to 1.5.2
CVE-2019-12239—
Medium6.1Unauthenticated Stored Cross-Site Scripting from Visitors
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce≤4.8Update to 4.8.1
CVE-2019-15112—
Medium6.1Unauthenticated Stored Cross-Site Scripting
FV Flowplayer Video Player≤7.3.13.727Update to 7.3.14.727
CVE-2019-14799—
Critical9.8SQL Injection
FV Flowplayer Video Player<7.3.15.727Update to 7.3.15.727
CVE-2019-14801—
Medium5.3Sensitive Information Exposure
FV Flowplayer Video Player≤7.3.14.727Update to 7.3.15.727
CVE-2019-14800—
High8.1Object Injection Bypass
OptionTree≤2.7.2Update to 2.7.3
CVE-2019-15320—
High8.1Object Injection Bypass
OptionTree≤2.7.2Update to 2.7.3
CVE-2019-15321—
Medium5.4Cross-Site Scripting via show_products_page_limit parameter
Woocommerce Products Price Bulk Edit≤2.0No patch available
CVE-2019-14796—
Medium4.8Cross-Site Scripting
Toggle The Title≤1.4No patch available
CVE-2019-14795—
Critical9.3Unauthenticated SQL Injection
FV Flowplayer Video Player<7.3.15.727Update to 7.3.15.727
——
Medium4.9Authenticated Local File Inclusion
Photo Gallery by 10Web – Mobile-Friendly Image Gallery≤1.5.24Update to 1.5.25
CVE-2019-14798—
Medium5.4Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform<2.4.7Update to 2.4.7
CVE-2019-15317—
Medium6.1Unauthenticated Stored Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging≤8.0.26Update to 8.0.27
CVE-2019-14950—
Medium5.4Authenticated Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery≤1.5.22Update to 1.5.23
CVE-2019-14797—
Critical9.4Arbitrary File Deletion/Read
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.0.45Update to 2.0.46
——
High7.5Unauthenticated Arbitrary File Read
diarise≤1.5.9No patch available
CVE-2019-25779—
High8.8Authenticated SQL Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder<1.13.3Update to 1.13.3
CVE-2019-10866—
Medium6.1Cross-Site Scripting
Ultimate FAQ Accordion Plugin<1.8.22Update to 1.8.22
CVE-2019-15643—
Critical9.8Administrative User Creation
WPGraphQL≤0.2.3Update to 0.3.0
CVE-2019-9879—
Critical9.1Information Exposure
WPGraphQL≤0.2.3Update to 0.3.0
CVE-2019-9880—
High7.5Information Exposure
Gravity Forms≤2.4.8Update to 2.4.9
CVE-2020-13764—
Medium5.4Authenticated Cross-Site Scripting
Custom Field Suite≤2.5.14Update to 2.5.15
CVE-2019-11871—
Medium5.3Unauthenticated Comment Creation
WPGraphQL≤0.2.3Update to 0.3.0
CVE-2019-9881—
Critical9.8Arbitrary File Upload
wp-live-chat-support-pro≤8.0.26Update to 8.0.27
CVE-2019-11185—
Critical9.8PHP Object Injection
Carts Guru≤1.4.5Update to 1.4.6
CVE-2019-12241—
Critical9.8PHP Object Injection
Virim≤0.4No patch available
CVE-2019-12240—
High7.5Sensitive Information Disclosure
WP Backup+≤2018-11-22No patch available
CVE-2018-19456—
Medium6.1Reflected Cross-Site Scripting
Blog2Social: Social Media Auto Post & Scheduler<5.0.3Update to 5.0.3
CVE-2019-9576—
Critical9.8Unauthenticated Arbitrary File Upload
User Submitted Posts – Enable Users to Submit Posts from the Front End<20190426Update to 20190426
CVE-2019-25138—

Search VulnCrest Radar

Jump to

Are you sure?