Database
Critical WordPress vulnerabilities (page 1314)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SEO Spam Injection (Hidden Functionality) | — | — | |
| Medium5.0 | Directory Traversal | CVE-2017-2245 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18554 | — | |
| High7.5 | Local File Inclusion | CVE-2017-11658 | — | |
| Critical9.8 | SQL Injection | — | — | |
| Medium6.4 | Authenticated Cross-Site Scripting | CVE-2017-2224 | — | |
| Critical9.8 | Unauthenticated Local File Inclusion | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18032 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2222 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-2216 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18563 | — | |
| High8.8 | SQL Injection | CVE-2017-9603 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2017-1002017 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-9419 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-2195 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2017-9429 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-9420 | — | |
| High8.8 | SQL Injection | CVE-2017-9418 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002018 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002019 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-15863 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18512 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002023 | — | |
| Critical9.8 | Authenticated SQL Injection | CVE-2017-1002020 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002021 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-1002022 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18523 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18522 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2169 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9063 | — |
- Critical9.8SEO Spam Injection (Hidden Functionality)
Display Widgets
<2.7Update to 2.7
- Medium5.0Directory Traversal
Shortcodes Ultimate – Content Elements
<4.10.0Update to 4.10.0
- Medium6.1Cross-Site Scripting
Analytics Tracker
≤1.1.0Update to 1.1.1
- High7.5Local File Inclusion
WP Rocket
<2.10.4Update to 2.10.4
- Critical9.8SQL Injection
Email Before Download
<4.0Update to 4.0
- Medium6.4Authenticated Cross-Site Scripting
Event Calendar WD version
<1.0.94Update to 1.0.94
- Critical9.8Unauthenticated Local File Inclusion
Autoptimize
≤2.1.0Update to 2.1.1
- Medium6.1Cross-Site Scripting
Download Manager
≤2.9.51Update to 2.9.52
- Medium6.1Cross-Site Scripting
WP-Members Membership Plugin
<3.1.8Update to 3.1.8
- Medium6.1Reflected Cross-Site Scripting
Download Manager
<2.9.50Update to 2.9.50
- Medium6.1Cross-Site Scripting
RSVP and Event Management
<2.3.8Update to 2.3.8
- High8.8SQL Injection
WP Jobs
<1.5Update to 1.5
- High7.2Stored Cross-Site Scripting
Gift Certificate Creator
≤1.0Update to 1.1
- Medium6.1Cross-Site Scripting
WP Custom Fields Search
<1.0Update to 1.0
- High8.8Authenticated SQL Injection
Multi Feed Reader
≤2.2.3Update to 2.2.4
- High7.2Authenticated (Admin+) SQL Injection
Event List
<0.7.9Update to 0.7.9
- Medium6.1Reflected Cross-Site Scripting
Spiffy Calendar
<3.3.0Update to 3.3.0
- High8.8SQL Injection
WP-Testimonials
≤3.4.1No patch available
- Critical9.8SQL Injection
Eventr
≤1.02.2No patch available
- Critical9.8SQL Injection
Eventr
≤1.02.2No patch available
- Medium6.1Reflected Cross-Site Scripting
wp-noexternallinks
<3.5.19Update to 3.5.19
- High8.8Cross-Site Request Forgery
Newsletter by Supsystic
<1.1.8Update to 1.1.8
- Critical9.8SQL Injection
Easy Team Manager
≤1.3.2No patch available
- Critical9.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- Critical9.8SQL Injection
surveys
≤1.01.8No patch available
- High8.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- High8.8Cross-Site Request Forgery
EELV Newsletter
≤4.6.0Update to 4.6.1
- Medium6.1Cross-Site Scripting
EELV Newsletter
<4.6.1Update to 4.6.1
- Medium6.1Cross-Site Scripting
MaxButtons – Create buttons
≤6.18Update to 6.19
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5