Database
Critical WordPress vulnerabilities (page 1300)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.1 | Remote Code Execution | CVE-2018-20156 | — | |
| Medium5.5 | Cross-Site Scripting | CVE-2018-5668 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting via Comments WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20153 | — | |
| High7.7 | Arbitrary File Deletion WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20147 | — | |
| High8.8 | PHP Object Injection WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20148 | — | |
| Medium6.4 | Stored Cross-Site Scripting via File Uploads WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20149 | — | |
| Medium6.1 | WordPress Core < 5.0.1 Reflected Cross-Site Scripting WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20150 | — | |
| Medium4.3 | Authorization Bypass WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20152 | — | |
| High7.5 | Sensitive Information Disclosure WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20151 | — | |
| Medium6.1 | Import Cross-Site Scripting | CVE-2018-20101 | — | |
| High7.5 | Arbitrary File Read | CVE-2019-15330 | — | |
| Critical9.8 | Cross-Site Scripting | — | — | |
| Medium5.4 | Author+ Stored Cross-Site Scripting | CVE-2018-20986 | — | |
| Critical9.8 | Local File Inclusion | CVE-2018-20985 | — | |
| High8.8 | Authenticated SQL Injection via Settings Import | CVE-2019-15872 | — | |
| Medium5.3 | User Enumeration | CVE-2018-19487 | — | |
| High8.8 | Unauthenticated Arbitrary Password Reset | CVE-2018-19488 | — | |
| Medium4.7 | Authenticated Open Redirect Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.19Update to 3.3.19.1 | CVE-2018-19796 | — | |
| Critical9.8 | Improper Access Control | CVE-2018-21007 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2018-19564 | — | |
| Critical9.8 | PHP Object Injection | CVE-2018-20984 | — | |
| Critical9.8 | Remote Code Execution | — | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2018-20838 | — | |
| Medium6.1 | Cross-Site Scripting via begin_date, end_date, or form_id Parameter Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.3.18Update to 3.3.18 | CVE-2018-19287 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-20368 | — | |
| High7.5 | Directory Traversal | CVE-2018-5310 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-5669 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2018-5311 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-5655 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2018-5312 | — |
- Critical9.1Remote Code Execution
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium5.5Cross-Site Scripting
Read and Understood
<2.2Update to 2.2
- Medium6.4Authenticated Stored Cross-Site Scripting via Comments
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.7Arbitrary File Deletion
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High8.8PHP Object Injection
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.4Stored Cross-Site Scripting via File Uploads
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1WordPress Core < 5.0.1 Reflected Cross-Site Scripting
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium4.3Authorization Bypass
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.5Sensitive Information Disclosure
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1Import Cross-Site Scripting
Import and export users and customers
<1.12.1Update to 1.12.1
- High7.5Arbitrary File Read
WebP Express
<0.14.11Update to 0.14.11
- Critical9.8Cross-Site Scripting
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤2.9.1Update to 3.0.0
- Medium5.4Author+ Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.7.8Update to 5.7.8
- Critical9.8Local File Inclusion
WP Payeezy Pay
<2.98Update to 2.98
- High8.8Authenticated SQL Injection via Settings Import
LoginPress | wp-login Custom Login Page Customizer
<1.1.16Update to 1.1.16
- Medium5.3User Enumeration
WP JobHunt
<2.4Update to 2.4
- High8.8Unauthenticated Arbitrary Password Reset
WP JobHunt
<2.4Update to 2.4
- Medium4.7Authenticated Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.19Update to 3.3.19.1
- Critical9.8Improper Access Control
User Email Verification for WooCommerce
≤3.1.15Update to 3.2.0
- Medium6.1Stored Cross-Site Scripting
Easy Testimonials
<3.6Update to 3.6
- Critical9.8PHP Object Injection
Patreon WordPress
<1.2.2Update to 1.2.2
- Critical9.8Remote Code Execution
Property Hive
<1.4.26Update to 1.4.26
- Medium5.4Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤0.9.97.20Update to 0.9.97.21
- Medium6.1Cross-Site Scripting via begin_date, end_date, or form_id Parameter
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.3.18Update to 3.3.18
- Medium5.4Authenticated Stored Cross-Site Scripting
Master Slider – Responsive Touch Slider
≤3.7.0Update to 3.7.5
- High7.5Directory Traversal
Media from FTP
<9.85Update to 9.85
- High8.8Cross-Site Request Forgery
Read and Understood
<2.2Update to 2.2
- Medium5.4Stored Cross-Site Scripting
Easy Custom Auto Excerpt
<2.4.7Update to 2.4.7
- Medium6.1Cross-Site Scripting
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- Medium5.4Stored Cross-Site Scripting
Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs
≤1.8.0Update to 2.0.0