VulnCrest
Search
Create account
Report an incident
Radar sectionsCritical
Check my site

Database

Critical WordPress vulnerabilities (page 1301)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

Signals
Software

41,567 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1301)
SeverityVulnerabilityCVEInstallsPublished
Medium5.4Stored Cross-Site Scripting
Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs≤1.8.0Update to 2.0.0
CVE-2018-5312—
Critical9.8Arbitrary Options Update
Social Sharing Plugin – Kiwi≤2.0.10Update to 2.0.11
——
Critical9.8SQL Injection
BuddyForms≤2.2.7Update to 2.2.8
CVE-2018-21003—
Medium6.1Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤3.0.12Update to 3.1.0
CVE-2018-16173—
Medium6.1Open Redirect
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤3.0.12Update to 3.1.0
CVE-2018-16174—
High7.2Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤3.0.12Update to 3.1.0
CVE-2018-16175—
Critical9.8Arbitrary Options Update and Action Calling
Cookie Information | Free GDPR Consent Solution<1.4.3Update to 1.4.3
CVE-2018-19207—
Critical9.8SQL Injection
RSVPMaker<5.6.4Update to 5.6.4
CVE-2018-21004—
Medium6.6Race Condition to Remote Code Execution
Yoast SEO – Advanced SEO with real-time guidance and built-in AI≤9.1.0Update to 9.2.0
CVE-2018-19370—
High7.2WooCommerce File Deletion
WooCommerce<3.4.6Update to 3.4.6
CVE-2018-20714—
Medium6.1Reflected Cross-Site Scripting
Media File Manager≤1.4.2Update to 1.4.3
CVE-2018-19041—
Medium5.4Cross-Site Scripting
Event Calendar WD version≤1.1.21Update to 1.1.22
CVE-2018-16164—
Medium4.8Cross-Site Scripting
WP Editor.md – The Perfect WordPress Markdown Editor<10.0.4Update to 10.0.4
CVE-2018-18919—
Critical9.8Arbitrary File Upload
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership≤1.4.13Update to 1.4.14
CVE-2019-1010209—
Medium5.4Authenticated Stored Cross-Site Scripting
Calendar<1.3.11Update to 1.3.11
CVE-2018-18872—
Critical9.8SQL Injection
Rockhoist Ratings<1.2.3Update to 1.2.3
——
Medium6.1Cross-Site Scripting
Elementor Website Builder Pro<2.0.10Update to 2.0.10
CVE-2018-18379—
High7.5Unauthenticated Arbitrary File Deletion via Path Traversal
ARforms<3.5.2Update to 3.5.2
CVE-2018-15818—
Critical9.8Arbitrary File Upload
Arigato Autoresponder and Newsletterall versionsNo patch available
CVE-2018-18461—
Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging≤8.0.15Update to 8.0.16
CVE-2018-18460—
Medium6.4Cross-Site Scripting
Support Board<1.2.4Update to 1.2.4
CVE-2018-18373—
Critical9.8Arbitrary File Upload
Tajer≤1.0.5No patch available
CVE-2018-9206—
High8.8Cross-Site Request Forgery via page to wpfastestcacheoptions
WP Fastest Cache – WordPress Cache Plugin≤0.8.8.5Update to 0.8.8.6
CVE-2018-17584—
Medium6.1Cross-Site Scripting via rules[0][content] parameter
WP Fastest Cache – WordPress Cache Plugin≤0.8.8.5Update to 0.8.8.6
CVE-2018-17586—
Medium6.1Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter
WP Fastest Cache – WordPress Cache Plugin≤0.8.8.5Update to 0.8.8.6
CVE-2018-17585—
Medium6.1Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action
WP Fastest Cache – WordPress Cache Plugin≤0.8.8.5Update to 0.8.8.6
CVE-2018-17583—
High7.2Unauthenticated Stored Cross-Site Scripting
WPML Multilingual CMS≤3.6.3Update to 4.0
CVE-2018-18069—
Medium6.1Multiple Cross-Site Scripting vulnerabilities
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.0.27Update to 2.0.28
CVE-2018-17866—
High7.2SQL Injection
Slideshow Gallery LITE≤1.6.8Update to 1.6.9
CVE-2018-18018—
Medium6.1Cross-Site Scripting
Slideshow Gallery LITE≤1.6.8Update to 1.6.9
CVE-2018-18019—

Search VulnCrest Radar

Jump to

Are you sure?