Database
Critical WordPress vulnerabilities (page 1312)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Cross-Site Scripting via Template Name WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14720 | — | |
| Medium6.4 | Cross-Site Scripting via Shortcodes WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14726 | — | |
| Medium6.4 | Cross-Site Scripting in oEmbed WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14724 | — | |
| Medium4.9 | Directory Traversal via Customizer WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14722 | — | |
| High7.5 | Arbitrary Settings Change | CVE-2017-18584 | — | |
| Critical9.8 | PHP Object Injection | CVE-2017-18583 | — | |
| Critical9.8 | Remote Code Execution | — | — | |
| Medium6.1 | Reflected Cross-site Scripting | CVE-2017-18599 | — | |
| High8.8 | Human Resource Management System < 1.1 - SQL Injection | CVE-2017-14848 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18577 | — | |
| High7.5 | Unauthenticated Backup Download | CVE-2017-2551 | — | |
| Medium6.1 | Unauthorized Cross-Site Scripting | CVE-2017-14126 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18535 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18546 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-10837 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18534 | — | |
| Medium4.7 | Reflected Cross Site Scripting | CVE-2017-20193 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18497 | — | |
| High7.2 | Authenticated SQL Injection via tag_id Parameter | CVE-2017-12977 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-15375 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18561 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18488 | — | |
| Medium6.1 | Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting | CVE-2017-13138 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-12651 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2017-18593 | — | |
| Critical9.8 | Blind SQL Injection | CVE-2017-12650 | — | |
| High7.2 | SQL Injection | CVE-2017-12947 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2017-12946 | — | |
| High8.0 | Authenticated SQL Injection | CVE-2017-12949 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-12948 | — |
- Medium6.4Cross-Site Scripting via Template Name
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium6.4Cross-Site Scripting via Shortcodes
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium6.4Cross-Site Scripting in oEmbed
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium4.9Directory Traversal via Customizer
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- High7.5Arbitrary Settings Change
Post Pay Counter
<2.731Update to 2.731
- Critical9.8PHP Object Injection
Post Pay Counter
<2.731Update to 2.731
- Critical9.8Remote Code Execution
Jetpack VaultPress
≤1.9Update to 1.9.1
- Medium6.1Reflected Cross-site Scripting
Pinfinity
≤1.9.2Update to 2.0
- High8.8Human Resource Management System < 1.1 - SQL Injection
WPHRM – Human Resource Management System for Wordpress | WordPress
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
MC4WP: Mailchimp for WordPress
≤4.1.7Update to 4.1.8
- High7.5Unauthenticated Backup Download
BackWPup – WordPress Backup & Restore Plugin
<3.4.2Update to 3.4.2
- Medium6.1Unauthorized Cross-Site Scripting
Participants Database
≤1.7.5.9Update to 1.7.5.10
- Medium6.1Cross-Site Scripting
SmokeSignal
≤1.2.6Update to 1.2.7
- High8.8Cross-Site Request Forgery
Jayj Quicktag
<1.3.2Update to 1.3.2
- Medium6.1Reflected Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
≤1.1.46Update to 1.1.47
- Medium6.1Reflected Cross-Site Scripting
Share on Diaspora
<0.7.2Update to 0.7.2
- Medium4.7Reflected Cross Site Scripting
Product Vendors
<2.0.36Update to 2.0.36
- Medium6.1Cross-Site Scripting
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.4.0Update to 3.4.0
- High7.2Authenticated SQL Injection via tag_id Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.3.51Update to 1.3.51
- Medium6.1Cross-Site Scripting
WP Job Board
≤4.5.1Update to 5.0
- Medium6.1Cross-Site Scripting
Embed Images in Comments
<0.6Update to 0.6
- Medium6.1Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
<1.1.47Update to 1.1.47
- Medium6.1Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting
Bridge - Creative Multipurpose WordPress Theme
<11.2Update to 11.2
- High8.8Cross-Site Request Forgery
Loginizer
<1.3.6Update to 1.3.6
- Medium5.4Stored Cross-Site Scripting
UpdraftPlus Premium
≤1.13.4Update to 1.13.5
- Critical9.8Blind SQL Injection
Loginizer
<1.3.6Update to 1.3.6
- High7.2SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
- High7.2Authenticated (Admin+) SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
- High8.0Authenticated SQL Injection
Podlove Podcast Publisher
<2.6.0Update to 2.6.0
- Medium6.1Cross-Site Scripting
PressForward
<5.2.4Update to 5.2.4