Database

Critical WordPress vulnerabilities (page 1305)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1305)
Severity	Vulnerability	CVE	Installs	Published
Medium4.3	Authenticated Unrestricted File Upload Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.0.4Update to 2.0.4	CVE-2018-0587	—	May 10, 2018
Medium4.3	Directory Traversal Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤2.0.39Update to 2.0.40	CVE-2018-0588	—	May 10, 2018
High7.5	Remote Code Execution Google Forms<0.94Update to 0.94	CVE-2018-20988	—	May 8, 2018
Medium5.5	Authenticated (Admin+) Stored Cross-Site Scripting Tagregator≤0.6No patch available	CVE-2018-10752	—	May 5, 2018
Medium6.1	Cross-Site Scripting WF Cookie Consent<1.1.4Update to 1.1.4	CVE-2018-10371	—	May 1, 2018
Medium6.1	Reflected Cross-Site Scripting Social Preview and Open Graph Tags<2.2.4.1Update to 2.2.4.1	CVE-2018-0579	—	Apr 27, 2018
Medium5.4	Reflected Cross-Site Scripting PixelYourSite – Your smart PIXEL (TAG) & API Manager<5.3.0Update to 5.3.0	CVE-2018-0578	—	Apr 27, 2018
Medium5.4	Stored Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.9Update to 5.9	CVE-2018-0576	—	Apr 27, 2018
Medium5.4	Cross-Site Scripting WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<4.0.4Update to 4.0.4	CVE-2018-0577	—	Apr 27, 2018
High7.8	CSV Injection Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder<1.12.22Update to 1.12.22	CVE-2018-10504	—	Apr 27, 2018
Medium5.4	Cross-Site Scripting Responsive Cookie Consent<1.8Update to 1.8	CVE-2018-10309	—	Apr 24, 2018
Medium6.1	Cross-Site Scripting WD Instagram Feed Premium≤1.3.0Update to 1.3.1	CVE-2018-10301	—	Apr 23, 2018
Medium5.5	Authenticated Cross-Site Scripting Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.0.11Update to 2.0.11	CVE-2018-10234	—	Apr 23, 2018
Medium6.1	Cross-site scripting 10WebSocial<1.3.1Update to 1.3.1	CVE-2018-10300	—	Apr 23, 2018
High8.8	Multiple Cross-Site Request Forgery Issues Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.0.7Update to 2.0.7	CVE-2018-10233	—	Apr 23, 2018
Medium6.4	Stored Cross-Site Scripting Termly – GDPR/CCPA Cookie Consent Banner≤2.3.9Update to 2.3.10	CVE-2018-10310	—	Apr 22, 2018
Medium5.5	Cross Site Scripting Caldera Forms – More Than Contact Forms≤1.5.9.1Update to 1.6.0	CVE-2018-7747	—	Apr 20, 2018
Medium6.1	Reflected Cross-Site Scripting Knews Multilingual Newsletters≤1.1.0Update to 1.1.1	CVE-2012-20004	—	Apr 13, 2018
Medium6.1	Stored Cross-Site Scripting 3CX Free Live Chat, Calls & Messaging≤8.0.05Update to 8.0.06	CVE-2018-9864	—	Apr 9, 2018
High8.6	CSV Injection Contact Form DB2.10.32 – 2.10.32Update to 2.10.36	CVE-2018-9035	—	Apr 9, 2018
Medium6.1	Stored Cross-Site Scripting Iptanus File Upload<4.3.4Update to 4.3.4	CVE-2018-9844	—	Apr 6, 2018
High7.5	Directory Traversal WP Background Takeover≤4.1.4Update to 4.1.5	CVE-2018-9118	—	Apr 6, 2018
Medium5.4	Open Redirect WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5	CVE-2018-10100	—	Apr 3, 2018
Medium6.4	Authenticated Stored Cross-Site Scripting via Generator Tag WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5	CVE-2018-10102	—	Apr 3, 2018
Medium4.3	Security Misconfiguration with URL Hostnames WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5	CVE-2018-10101	—	Apr 3, 2018
Medium4.1	Cross-Site Scripting via Shortcodes Iptanus File Upload<4.3.3Update to 4.3.3	CVE-2018-9172	—	Mar 31, 2018
Medium5.4	Cross-Site Scripting Relevanssi – A Better Search≤4.0.4Update to 4.0.5	CVE-2018-9034	—	Mar 30, 2018
Medium6.5	Cross-Site Request Forgery to Denial of Service WP Image Zoom≤1.23Update to 1.24	CVE-2018-1000510	—	Mar 29, 2018
Medium5.3	Sensitive Information Disclosure WP Activity Log≤3.1.1Update to 3.1.2	CVE-2018-8719	—	Mar 28, 2018
Medium6.4	Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.8.1.2Update to 5.8.1.2	CVE-2018-9020	—	Mar 26, 2018

Medium4.3
Authenticated Unrestricted File Upload
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
CVE-2018-0587May 10, 2018
Medium4.3
Directory Traversal
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
CVE-2018-0588May 10, 2018
High7.5
Remote Code Execution
Google Forms
<0.94Update to 0.94
CVE-2018-20988May 8, 2018
Medium5.5
Authenticated (Admin+) Stored Cross-Site Scripting
Tagregator
≤0.6No patch available
CVE-2018-10752May 5, 2018
Medium6.1
Cross-Site Scripting
WF Cookie Consent
<1.1.4Update to 1.1.4
CVE-2018-10371May 1, 2018
Medium6.1
Reflected Cross-Site Scripting
Social Preview and Open Graph Tags
<2.2.4.1Update to 2.2.4.1
CVE-2018-0579Apr 27, 2018
Medium5.4
Reflected Cross-Site Scripting
PixelYourSite – Your smart PIXEL (TAG) & API Manager
<5.3.0Update to 5.3.0
CVE-2018-0578Apr 27, 2018
Medium5.4
Stored Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.9Update to 5.9
CVE-2018-0576Apr 27, 2018
Medium5.4
Cross-Site Scripting
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<4.0.4Update to 4.0.4
CVE-2018-0577Apr 27, 2018
High7.8
CSV Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
<1.12.22Update to 1.12.22
CVE-2018-10504Apr 27, 2018
Medium5.4
Cross-Site Scripting
Responsive Cookie Consent
<1.8Update to 1.8
CVE-2018-10309Apr 24, 2018
Medium6.1
Cross-Site Scripting
WD Instagram Feed Premium
≤1.3.0Update to 1.3.1
CVE-2018-10301Apr 23, 2018
Medium5.5
Authenticated Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.11Update to 2.0.11
CVE-2018-10234Apr 23, 2018
Medium6.1
Cross-site scripting
10WebSocial
<1.3.1Update to 1.3.1
CVE-2018-10300Apr 23, 2018
High8.8
Multiple Cross-Site Request Forgery Issues
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.7Update to 2.0.7
CVE-2018-10233Apr 23, 2018
Medium6.4
Stored Cross-Site Scripting
Termly – GDPR/CCPA Cookie Consent Banner
≤2.3.9Update to 2.3.10
CVE-2018-10310Apr 22, 2018
Medium5.5
Cross Site Scripting
Caldera Forms – More Than Contact Forms
≤1.5.9.1Update to 1.6.0
CVE-2018-7747Apr 20, 2018
Medium6.1
Reflected Cross-Site Scripting
Knews Multilingual Newsletters
≤1.1.0Update to 1.1.1
CVE-2012-20004Apr 13, 2018
Medium6.1
Stored Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.05Update to 8.0.06
CVE-2018-9864Apr 9, 2018
High8.6
CSV Injection
Contact Form DB
2.10.32 – 2.10.32Update to 2.10.36
CVE-2018-9035Apr 9, 2018
Medium6.1
Stored Cross-Site Scripting
Iptanus File Upload
<4.3.4Update to 4.3.4
CVE-2018-9844Apr 6, 2018
High7.5
Directory Traversal
WP Background Takeover
≤4.1.4Update to 4.1.5
CVE-2018-9118Apr 6, 2018
Medium5.4
Open Redirect
WordPress
≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10100Apr 3, 2018
Medium6.4
Authenticated Stored Cross-Site Scripting via Generator Tag
WordPress
≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10102Apr 3, 2018
Medium4.3
Security Misconfiguration with URL Hostnames
WordPress
≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10101Apr 3, 2018
Medium4.1
Cross-Site Scripting via Shortcodes
Iptanus File Upload
<4.3.3Update to 4.3.3
CVE-2018-9172Mar 31, 2018
Medium5.4
Cross-Site Scripting
Relevanssi – A Better Search
≤4.0.4Update to 4.0.5
CVE-2018-9034Mar 30, 2018
Medium6.5
Cross-Site Request Forgery to Denial of Service
WP Image Zoom
≤1.23Update to 1.24
CVE-2018-1000510Mar 29, 2018
Medium5.3
Sensitive Information Disclosure
WP Activity Log
≤3.1.1Update to 3.1.2
CVE-2018-8719Mar 28, 2018
Medium6.4
Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.8.1.2Update to 5.8.1.2
CVE-2018-9020Mar 26, 2018