Database
Critical WordPress vulnerabilities (page 1315)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | User Enumeration | CVE-2017-1000226 | — | |
| Medium6.3 | Mishandling Post Meta Values via XML-RPC WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9062 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9063 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2169 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2187 | — | |
| High7.7 | Server-Side Request Forgery WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9066 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2168 | — | |
| Medium5.4 | Authorization Bypass Allowing Post Meta Updates WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9065 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18578 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18547 | — | |
| High7.5 | Directory Traversal | CVE-2017-1000170 | — | |
| Medium5.9 | Unauthorized Password Reset via Interception | CVE-2017-8295 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18559 | — | |
| Critical9.8 | Object Injection | CVE-2017-18605 | — | |
| Critical9.8 | PHP Object Injection | — | — | |
| Critical9.8 | PHP Object Injection | CVE-2017-18604 | — | |
| Critical9.8 | PHP Object Injection | — | — | |
| Critical9.8 | PHP Object Injection | — | — | |
| Critical9.8 | Timing Attack | — | — | |
| Critical9.6 | CSV Injection | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10706 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18607 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2017-18606 | — | |
| Critical9.8 | Arbitrary file upload | CVE-2017-1002016 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2017-18570 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-18592 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-20008 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18498 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18608 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18500 | — |
- Medium5.3User Enumeration
Stop User Enumeration
<1.3.9Update to 1.3.9
- Medium6.3Mishandling Post Meta Values via XML-RPC
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
MaxButtons – Create buttons
≤6.18Update to 6.19
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.0.06Update to 7.0.07
- High7.7Server-Side Request Forgery
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
WP Booking System – Booking Calendar
<1.4Update to 1.4
- Medium5.4Authorization Bypass Allowing Post Meta Updates
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
Crafty Social Buttons
<1.5.8Update to 1.5.8
- High8.8Cross-Site Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
<4.6.4Update to 4.6.4
- High7.5Directory Traversal
Task Scheduler
≤1.6.0Update to 1.6.1
- Medium5.9Unauthorized Password Reset via Interception
WordPress
<5.5Update to 5.5
- Medium6.1Cross-Site Scripting
cformsII
≤14.13.2Update to 14.13.3
- Critical9.8Object Injection
Gravitate QA Tracker
≤1.2.1No patch available
- Critical9.8PHP Object Injection
AJAX Random Posts
≤0.3.3No patch available
- Critical9.8PHP Object Injection
SiteBuilder Dynamic Components
≤1.0No patch available
- Critical9.8PHP Object Injection
Referrer Detector
≤4.2.1.0No patch available
- Critical9.8PHP Object Injection
My Geo Posts Free
≤1.2No patch available
- Critical9.8Timing Attack
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.2Update to 4.2
- Critical9.6CSV Injection
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.2Update to 4.2
- Medium6.1Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.3Update to 4.0.3
- High8.8Cross-Site Request Forgery
Avada | Website Builder For WordPress & WooCommerce
<5.1.5Update to 5.1.5
- Medium6.1Stored Cross-Site Scripting
Avada | Website Builder For WordPress & WooCommerce
<5.1.5Update to 5.1.5
- Critical9.8Arbitrary file upload
flickr-picture-backup
≤0.7No patch available
- High7.2Authenticated SQL Injection
cformsII
<14.13Update to 14.13
- Critical9.8Arbitrary File Upload
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
≤3.0.5Update to 3.1.0
- Medium6.1Reflected Cross-Site Scripting
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<1.7.8Update to 1.7.8
- Medium6.1Reflected Cross-Site Scripting
Simple Job Board
<2.4.4Update to 2.4.4
- Medium6.1Cross-Site Scripting
Spot.IM Comments
<4.0.4Update to 4.0.4
- Medium6.1Reflected Cross-Site Scripting
Social Buttons Pack by BestWebSoft
<1.1.1Update to 1.1.1