Database
Critical WordPress vulnerabilities (page 1309)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter | CVE-2018-6357 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-5213 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-5212 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2018-3811 | — | |
| Medium6.1 | Open Redirect | CVE-2017-1000434 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2018-3810 | — | |
| Critical9.8 | Malicious Backdoor | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17869 | — | |
| Critical9.6 | 4.4.4 - Plugin Backdoor | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17744 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17719 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2017-16949 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2017-17753 | — | |
| Medium6.1 | Multiple Versions - Cross-Site Scripting | CVE-2017-17780 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18015 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-5316 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17451 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18012 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18010 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-20970 | — | |
| Critical9.8 | 21.2.7 - Authentication Bypass | — | — | |
| Medium6.4 | WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17093 | — | |
| Medium5.4 | Authorization Bypass WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17091 | — | |
| Medium6.1 | Reflected Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17094 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17092 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18489 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-0511 | — | |
| High8.8 | Missing Authorization | CVE-2017-18596 | — | |
| Medium6.1 | Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting | CVE-2017-18555 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18495 | — |
- High8.8Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter
Social Media Widget by Acurax
<3.2.6Update to 3.2.6
- Medium5.4Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
- Medium6.4Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
- Critical9.8Unauthenticated SQL Injection
Smart Google Code Inserter
<3.5Update to 3.5
- Medium6.1Open Redirect
furikake
≤0.1.0Update to 0.1.1
- High7.2Stored Cross-Site Scripting
Smart Google Code Inserter
<3.5Update to 3.5
- Critical9.8Malicious Backdoor
Duplicate Page and Post
≤2.1.1No patch available
- Medium6.1Cross-Site Scripting
mgl-instagram-gallery
all versionsNo patch available
- Critical9.64.4.4 - Plugin Backdoor
Captcha
4.3.6 – 4.4.4Update to 4.4.5
- Medium6.1Cross-Site Scripting
Custom Map
≤1.1No patch available
- Medium6.1Cross-Site Scripting
WP Concours
≤1.1No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
accesspress-anonymous-post-pro
<3.2.0Update to 3.2.0
- Medium5.4Cross-Site Scripting
CSV Import Export
≤1.1No patch available
- Medium6.1Multiple Versions - Cross-Site Scripting
Clockwork SMS Notfications
≤2.0.3No patch available
- Medium6.1Cross-Site Scripting
Share This Image
<1.04Update to 1.04
- Medium6.1Cross-Site Scripting
SagePay Server Gateway for WooCommerce
<1.0.9Update to 1.0.9
- Medium6.1Cross-Site Scripting
WP Mailster
<1.5.5Update to 1.5.5
- Medium6.1Cross-Site Scripting
Z-URL Preview
<2.0.0Update to 2.0.0
- Medium6.1Cross-Site Scripting
Smart Marketing SMS and Newsletters Forms
<2.0.0Update to 2.0.0
- Medium6.1Reflected Cross-Site Scripting
PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin
<2.0.3Update to 2.0.3
- Critical9.821.2.7 - Authentication Bypass
Apocalypse Meow
21.1.3 – 21.2.7Update to 21.2.8
- Medium6.4WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium5.4Authorization Bypass
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium6.1Reflected Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium6.1Reflected Cross-Site Scripting
Contact Form 7 – Clockwork SMS
<2.4.1Update to 2.4.1
- Medium6.1Cross-Site Scripting
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
≤5.2.0Update to 5.2.2
- High8.8Missing Authorization
Elementor Website Builder – more than just a page builder
≤1.7.12Update to 1.8.0
- Medium6.1Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting
Booking Calendar – Clockwork SMS
≤1.0.5Update to 1.1.0
- Medium6.1Cross-Site Scripting
Clockwork SMS Notfications
<2.4.2Update to 2.4.2