Database
Critical WordPress vulnerabilities (page 1302)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2018-18017 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20972 | — | |
| Critical9.8 | Local File Inclusion | CVE-2018-20973 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2018-17573 | — | |
| High7.5 | Firewall Bypass | CVE-2019-17214 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-17213 | — | |
| High7.5 | Directory Traversal | CVE-2018-16299 | — | |
| Critical9.8 | Directory Traversal | CVE-2018-16283 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002007 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002008 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2018-1002006 | — | |
| High7.2 | SQL Injection | CVE-2018-1002000 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002001 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002004 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002009 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002002 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1002003 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2018-1002005 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-16966 | 1M+ | |
| Critical9.8 | Unauthenticated Arbitrary File Upload/Download | CVE-2018-25105 | 1M+ | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2018-16967 | 1M+ | |
| Critical9.8 | Privilege Escalation | — | — | |
| Critical9.8 | Privilege Escalation | CVE-2018-16613 | — | |
| High7.5 | PHAR Unserialization WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-1000773 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-16363 | 1M+ | |
| Medium6.3 | Authorization Bypass | CVE-2018-20979 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2018-16285 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-17138 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-17140 | — | |
| Critical9.8 | Sensitive Information Disclosure leading to Remote Code Execution Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More≤1.2.40Update to 1.2.42 | CVE-2018-17207 | 1M+ |
- Medium6.1Cross-Site Scripting
Slideshow Gallery LITE
≤1.6.8Update to 1.6.9
- High8.8Cross-Site Request Forgery
Companion Auto Update
<3.2.1Update to 3.2.1
- Critical9.8Local File Inclusion
Companion Auto Update
<3.2.1Update to 3.2.1
- Critical9.8Arbitrary File Upload
Wp-Insert
≤2.4.2Update to 2.4.3
- High7.5Firewall Bypass
WebARX
≤1.3.0No patch available
- Medium6.1Stored Cross-Site Scripting
WebARX
≤1.3.0No patch available
- High7.5Directory Traversal
Localize My Post
≤1.0No patch available
- Critical9.8Directory Traversal
微信群发助手-Wechat Broadcast
≤1.2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium4.8Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- High7.2SQL Injection
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium6.1Reflected Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- Medium4.8Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.5.1.8Update to 2.5.1.9
- High8.8Cross-Site Request Forgery
File Manager
≤3.0Update to 3.1
- Critical9.8Unauthenticated Arbitrary File Upload/Download
File Manager
≤3.0Update to 3.1
- Medium6.1Stored Cross-Site Scripting
File Manager
≤3.0Update to 3.1
- Critical9.8Privilege Escalation
UserPro - Community and User Profile WordPress Plugin
<4.9.28Update to 4.9.28
- Critical9.8Privilege Escalation
wpForo Forum
≤1.5.1Update to 1.5.2
- High7.5PHAR Unserialization
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1Reflected Cross-Site Scripting
File Manager
<3.0Update to 3.0
- Medium6.3Authorization Bypass
Contact Form 7
<5.0.4Update to 5.0.4
- Medium6.1Unauthenticated Cross-Site Scripting
UserPro - Community and User Profile WordPress Plugin
≤4.9.23Update to 4.9.24
- Medium6.4Authenticated Stored Cross-Site Scripting
Jibu Pro
≤1.7No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Quizlord
≤2.0No patch available
- Critical9.8Sensitive Information Disclosure leading to Remote Code Execution
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.40Update to 1.2.42