Database
Critical WordPress vulnerabilities (page 1304)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | SQL Injection | CVE-2019-1010104 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1000512 | — | |
| Critical9.8 | SQL Injection | CVE-2018-10969 | — | |
| High7.5 | Unauthenticated Parameter Manipulation | CVE-2018-10363 | — | |
| High7.3 | Missing Authorization | CVE-2018-11580 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-11633 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-11709 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11486 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-11632 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11485 | — | |
| Medium6.5 | Missing Authorization | CVE-2018-11579 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-0603 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20982 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-0602 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20974 | — | |
| Critical9.8 | Blind SQL Injection | CVE-2018-11309 | — | |
| Critical9.8 | SQL Injection | CVE-2018-11515 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2018-11366 | — | |
| High8.8 | Remote Code Execution | CVE-2019-15873 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-21012 | — | |
| Medium5.3 | Unauthorized Access to Information Disclosure | CVE-2018-21011 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-1000506 | — | |
| Medium4.3 | Improper Access Control | CVE-2018-0589 | — | |
| High7.2 | Cross-Site Scripting | CVE-2018-1000508 | — | |
| High7.5 | Missing Authorization | CVE-2018-1000511 | — | |
| Medium5.3 | Directory Traversal to Arbitrary File Read | CVE-2018-19043 | — | |
| Critical9.8 | Directory Traversal to Arbitrary File Relocation | CVE-2018-19042 | — | |
| Medium5.3 | Directory Traversal to Directory Listing | CVE-2018-19040 | — | |
| Medium4.3 | Authenticated Unrestricted File Upload | CVE-2018-0587 | — | |
| Medium4.3 | Insecure Direct Object Reference | CVE-2018-0590 | — |
- High8.8SQL Injection
Quick Chat
≤4.14No patch available
- Medium6.1Reflected Cross-Site Scripting
Tooltipy (tooltips for WP)
<5.1Update to 5.1
- Critical9.8SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
≤3.0.9Update to 3.0.10
- High7.5Unauthenticated Parameter Manipulation
Booking calendar, Appointment Booking System
≤2.2.2Update to 2.2.3
- High7.3Missing Authorization
Mass Pages/Posts Creator
≤1.2.2Update to 1.2.3
- Medium6.5Cross-Site Request Forgery
Digital Goods for WooCommerce Checkout
<2.2Update to 2.2
- Medium6.1Reflected Cross-Site Scripting
wpForo Forum
<1.4.12Update to 1.4.12
- Medium6.1Cross-Site Scripting
Advance Search for WooCommerce
<1.1Update to 1.1
- Medium6.5Cross-Site Request Forgery
Add Social Share Buttons for Whatsapp and Viber
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
Advance Search for WooCommerce
<1.1Update to 1.1
- Medium6.5Missing Authorization
Banner Management For WooCommerce
≤1.1.0Update to 1.1.1
- Medium6.1Cross-Site Scripting
Site Reviews
<2.15.3Update to 2.15.3
- Medium6.1Cross-Site Scripting
Media Library Assistant
<2.7.4Update to 2.74
- Medium6.1Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤3.4.12Update to 3.5.0
- High8.8Cross-Site Request Forgery
JS Job Manager
≤1.0.6Update to 1.0.7
- Critical9.8Blind SQL Injection
membermouse
≤2.2.8Update to 2.2.9
- Critical9.8SQL Injection
wpForo Forum
≤1.4.12Update to 1.4.13
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Loginizer
1.3.8 – 1.3.9Update to 1.4.0
- High8.8Remote Code Execution
ProfileGrid – User Profiles, Groups and Communities
<2.8.6Update to 2.8.6
- Medium6.1Cross-Site Scripting
CF7 Invisible reCAPTCHA
<1.3.2Update to 1.3.2
- Medium5.3Unauthorized Access to Information Disclosure
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
<1.5.14Update to 1.5.14
- High8.8Cross-Site Request Forgery
Metronet Tag Manager
<1.2.9Update to 1.2.9
- Medium4.3Improper Access Control
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.3Update to 2.0.4
- High7.2Cross-Site Scripting
WP ULike – Like Buttons, Voting & Engagement Analytics
<3.2Update to 3.2
- High7.5Missing Authorization
WP ULike – Like Buttons, Voting & Engagement Analytics
<3.2Update to 3.2
- Medium5.3Directory Traversal to Arbitrary File Read
Media File Manager
≤1.4.2Update to 1.4.3
- Critical9.8Directory Traversal to Arbitrary File Relocation
Media File Manager
≤1.4.2Update to 1.4.3
- Medium5.3Directory Traversal to Directory Listing
Media File Manager
≤1.4.2Update to 1.4.3
- Medium4.3Authenticated Unrestricted File Upload
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium4.3Insecure Direct Object Reference
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4