Database
Critical WordPress vulnerabilities (page 1303)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SQL Injection | CVE-2018-16159 | — | |
| Medium5.3 | CAPTCHA Reuse | CVE-2018-15876 | — | |
| High8.8 | Remote Command Injection | CVE-2018-15877 | — | |
| High7.3 | CSV Injection | CVE-2019-15092 | — | |
| High8.6 | CSV Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.13Update to 3.3.14 | CVE-2018-16308 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2018-14502 | — | |
| High8.8 | Insecure Deserialization | CVE-2017-1000600 | — | |
| High8.6 | CSV Injection | CVE-2018-15571 | — | |
| Medium6.6 | Authenticated(Administrator+) PHP File Upload WordPress≤6.4.2Update to 4.1.40 or 4.2.37 or 4.3.33 or 4.4.32 or 4.5.31 or 4.6.28 or 4.7.28 or 4.8.24 or 4.9.25 or 5.0.21 or 5.1.18 or 5.2.20 or 5.3.17 or 5.4.15 or 5.5.14 or 5.6.13 or 5.7.11 or 5.8.9 or 5.9.9 or 6.0.7 or 6.1.5 or 6.2.4 or 6.3.3 or 6.4.3 | CVE-2018-14028 | — | |
| Medium6.5 | Authenticated (Custom+) Arbitrary File Deletion | CVE-2018-25308 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20966 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-17884 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2018-14846 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2018-17947 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-14430 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2018-13137 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-21001 | — | |
| Medium6.4 | < 1.10.4 - Cross-Site Scripting | CVE-2018-14071 | — | |
| High7.2 | Local File Inclusion | CVE-2018-1000504 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2018-13832 | — | |
| Critical9.1 | Insufficient Restrictions during Export Personal Data requests | CVE-2018-20981 | — | |
| High8.8 | Authenticated Arbitrary File Deletion WordPress≤4.9.6Update to 3.7.27 or 3.8.27 or 3.9.25 or 4.0.24 or 4.1.24 or 4.2.21 or 4.3.17 or 4.4.16 or 4.5.15 or 4.6.12 or 4.7.11 or 4.8.7 or 4.9.7 | CVE-2018-12895 | — | |
| Medium6.1 | Authenticated Cross-Site Scripting | CVE-2018-13136 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11105 | — | |
| Medium6.1 | 6.6.4 - Cross-Site Scripting | CVE-2018-0642 | — | |
| High7.2 | Authenticated SQL Injection Kadence Security – Password, Two Factor Authentication, and Brute Force Protection<7.0.3Update to 7.0.3 | CVE-2018-12636 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-21002 | — | |
| Medium6.1 | CSV Injection | CVE-2018-11526 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-1000505 | — | |
| High7.8 | CSV Injection | CVE-2018-11525 | — |
- Critical9.8SQL Injection
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
<4.1.8Update to 4.1.8
- Medium5.3CAPTCHA Reuse
Ajax BootModal Login
≤1.4.3No patch available
- High8.8Remote Command Injection
Plainview Activity Monitor
<20180826Update to 20180826
- High7.3CSV Injection
Export and Import Users and Customers
<1.3.2Update to 1.3.2
- High8.6CSV Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.13Update to 3.3.14
- Critical9.8Unauthenticated SQL Injection
Chained Quiz
<1.0.9Update to 1.0.9
- High8.8Insecure Deserialization
WordPress
<4.9Update to 4.9
- High8.6CSV Injection
Export Users to CSV
≤1.1.1No patch available
- Medium6.6Authenticated(Administrator+) PHP File Upload
WordPress
≤6.4.2Update to 4.1.40 or 4.2.37 or 4.3.33 or 4.4.32 or 4.5.31 or 4.6.28 or 4.7.28 or 4.8.24 or 4.9.25 or 5.0.21 or 5.1.18 or 5.2.20 or 5.3.17 or 5.4.15 or 5.5.14 or 5.6.13 or 5.7.11 or 5.8.9 or 5.9.9 or 6.0.7 or 6.1.5 or 6.2.4 or 6.3.3 or 6.4.3
- Medium6.5Authenticated (Custom+) Arbitrary File Deletion
BuddyPress Xprofile Custom Fields Type
≤2.6.3No patch available
- Medium6.1Cross-Site Scripting
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<3.8.0Update to 3.8.0
- Medium6.1Cross-Site Scripting
Gwolle Guestbook
≤2.5.3Update to 2.5.4
- Medium6.4Stored Cross-Site Scripting
Multi Step Form
<1.2.6Update to 1.2.6
- Medium6.1Multiple Cross-Site Scripting
Snazzy Maps
≤1.1.4Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
Multi Step Form
<1.2.6Update to 1.2.6
- Medium4.8Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.4Update to 5.9.5
- Medium6.1Cross-Site Scripting
AnyComment
≤0.0.32Update to 0.0.33
- Medium6.4< 1.10.4 - Cross-Site Scripting
Geo Mashup
<1.10.4Update to 1.10.4
- High7.2Local File Inclusion
Redirection
≤2.7.3Update to 2.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
All In One Favicon
≤4.6Update to 4.7
- Critical9.1Insufficient Restrictions during Export Personal Data requests
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.8Update to 3.3.9
- High8.8Authenticated Arbitrary File Deletion
WordPress
≤4.9.6Update to 3.7.27 or 3.8.27 or 3.9.25 or 4.0.24 or 4.1.24 or 4.2.21 or 4.3.17 or 4.4.16 or 4.5.15 or 4.6.12 or 4.7.11 or 4.8.7 or 4.9.7
- Medium6.1Authenticated Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.17Update to 2.0.18
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.07Update to 8.0.08
- Medium6.16.6.4 - Cross-Site Scripting
FV Flowplayer Video Player
6.1.2 – 6.6.4Update to 6.6.5
- High7.2Authenticated SQL Injection
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
<7.0.3Update to 7.0.3
- High8.8Cross-Site Request Forgery
JS Help Desk – AI-Powered Support & Ticketing System
≤2.0.5Update to 2.0.6
- Medium6.1CSV Injection
Comments Import & Export
≤2.0.4Update to 2.0.5
- Medium6.5Cross-Site Request Forgery
Tooltipy (tooltips for WP)
<5.1Update to 5.1
- High7.8CSV Injection
Advanced Order Export For WooCommerce
≤1.5.4Update to 1.5.5