Database

Critical WordPress vulnerabilities (page 1316)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1316)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting Realty by BestWebSoft<1.1.0Update to 1.1.0	CVE-2017-18532	—	Apr 17, 2017
Medium6.1	Cross-Site Scripting BestWebSoft's LinkedIn<1.0.5Update to 1.0.5	CVE-2017-18516	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Timesheet by BestWebSoft<0.1.5Update to 0.1.5	CVE-2017-18590	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Rating by BestWebSoft<0.2Update to 0.2	CVE-2017-18530	—	Apr 17, 2017
Critical9.8	Shortcode Injection Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤1.3.83Update to 1.3.84	—	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting Error Log Viewer by BestWebSoft<1.0.6Update to 1.0.6	CVE-2017-18562	—	Apr 17, 2017
Medium6.1	Reflected Cross-Site Scripting PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website<1.1.1Update to 1.1.1	CVE-2017-18529	—	Apr 17, 2017
Medium6.1	Cross-Site Scripting Rimons Twitter Widget≤1.2.4Update to 1.3	CVE-2017-18533	—	Apr 16, 2017
Critical9.8	Stored Cross-Site Scripting Ultimate Addons for WPBakery≤3.16.11Update to 3.16.12	—	—	Apr 16, 2017
Medium6.1	Cross-Site Scripting PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin<1.9.4Update to 1.9.4	CVE-2017-18528	—	Apr 14, 2017
Medium6.1	Reflected Cross-Site Scripting Htaccess by BestWebSoft – WordPress Website Access Control Plugin<1.7.6Update to 1.7.6	CVE-2017-18496	—	Apr 14, 2017
Medium6.1	Cross-Site Scripting Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more<1.2.5Update to 1.2.5	CVE-2017-7723	—	Apr 14, 2017
Medium6.1	Stored Cross-Site Scripting WP Statistics – Simple, privacy-friendly Google Analytics alternative≤12.0.4Update to 12.0.5	CVE-2017-2136	—	Apr 13, 2017
Medium6.1	Reflected Cross-Site Scripting Testimonials by BestWebSoft≤0.1.8Update to 0.1.9	CVE-2017-18558	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting BestWebSoft’s Pinterest≤1.0.4Update to 1.0.5	CVE-2017-18517	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress<4.0.6Update to 4.0.6	CVE-2017-18491	—	Apr 12, 2017
Medium6.1	Multiple Cross-Site Scripting Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress≤1.5.6Update to 1.5.7	CVE-2017-18492	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting Custom Search by BestWebSoft – WordPress Custom Search Plugin≤1.35Update to 1.36	CVE-2017-18494	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting Custom Admin Page by BestWebSoft – Configurable WordPress Dashboard Pages Plugin≤0.1.1Update to 0.1.2	CVE-2017-18493	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting Contact Form Multi by BestWebSoft – Multiple Forms Plugin for Single WordPress Website<1.2.1Update to 1.2.1	CVE-2017-18490	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting Updater by BestWebSoft≤1.34Update to 1.35	CVE-2017-18565	—	Apr 12, 2017
Medium6.1	Reflected Cross-Site Scripting Visitors Online by BestWebSoft<1.0.0Update to 1.0.0	CVE-2017-18537	—	Apr 12, 2017
Medium6.1	ReflectedCross-Site Scripting Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress<3.96Update to 3.96	CVE-2015-9295	—	Apr 12, 2017
Medium6.1	Multiple Cross-Site Scripting Subscriber by BestWebSoft≤1.3.4Update to 1.3.5	CVE-2017-18502	—	Apr 12, 2017
Medium6.1	Multiple Cross-Site Scripting SMTP by BestWebSoft≤1.0.9Update to 1.1.0	CVE-2017-18518	—	Apr 12, 2017
Medium6.1	Multiple Cross-Site Scripting Social Login by BestWebSoft≤0.1Update to 0.2	CVE-2017-18501	—	Apr 12, 2017
Medium6.1	Multiple Cross-Site Scripting Analytics by BestWebSoft – Google Analytics Dashboard and Statistic Plugin for WordPress≤1.7.0Update to 1.7.1	CVE-2017-18556	—	Apr 12, 2017
Medium6.1	Cross-Site Scripting Help Center by BestWebSoft≤1.0.4Update to 1.0.5	CVE-2017-18542	—	Apr 12, 2017
Medium6.1	Multiple Cross-Site Scripting AdPush≤1.43Update to 1.44	CVE-2017-18487	—	Apr 12, 2017
Medium6.1	Cross-Site Scripting BestWebSoft's Twitter<2.55Update to 2.55	CVE-2017-18505	—	Apr 12, 2017

Medium6.1
Reflected Cross-Site Scripting
Realty by BestWebSoft
<1.1.0Update to 1.1.0
CVE-2017-18532Apr 17, 2017
Medium6.1
Cross-Site Scripting
BestWebSoft's LinkedIn
<1.0.5Update to 1.0.5
CVE-2017-18516Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Timesheet by BestWebSoft
<0.1.5Update to 0.1.5
CVE-2017-18590Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Rating by BestWebSoft
<0.2Update to 0.2
CVE-2017-18530Apr 17, 2017
Critical9.8
Shortcode Injection
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.83Update to 1.3.84
bab67a5c-3390-4423-8fa9-b5ffbc98324dApr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
Error Log Viewer by BestWebSoft
<1.0.6Update to 1.0.6
CVE-2017-18562Apr 17, 2017
Medium6.1
Reflected Cross-Site Scripting
PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website
<1.1.1Update to 1.1.1
CVE-2017-18529Apr 17, 2017
Medium6.1
Cross-Site Scripting
Rimons Twitter Widget
≤1.2.4Update to 1.3
CVE-2017-18533Apr 16, 2017
Critical9.8
Stored Cross-Site Scripting
Ultimate Addons for WPBakery
≤3.16.11Update to 3.16.12
6b48cae6-254c-4882-a464-3a44a63cadf5Apr 16, 2017
Medium6.1
Cross-Site Scripting
PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin
<1.9.4Update to 1.9.4
CVE-2017-18528Apr 14, 2017
Medium6.1
Reflected Cross-Site Scripting
Htaccess by BestWebSoft – WordPress Website Access Control Plugin
<1.7.6Update to 1.7.6
CVE-2017-18496Apr 14, 2017
Medium6.1
Cross-Site Scripting
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
<1.2.5Update to 1.2.5
CVE-2017-7723Apr 14, 2017
Medium6.1
Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.0.4Update to 12.0.5
CVE-2017-2136Apr 13, 2017
Medium6.1
Reflected Cross-Site Scripting
Testimonials by BestWebSoft
≤0.1.8Update to 0.1.9
CVE-2017-18558Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
BestWebSoft’s Pinterest
≤1.0.4Update to 1.0.5
CVE-2017-18517Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<4.0.6Update to 4.0.6
CVE-2017-18491Apr 12, 2017
Medium6.1
Multiple Cross-Site Scripting
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.5.6Update to 1.5.7
CVE-2017-18492Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
Custom Search by BestWebSoft – WordPress Custom Search Plugin
≤1.35Update to 1.36
CVE-2017-18494Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
Custom Admin Page by BestWebSoft – Configurable WordPress Dashboard Pages Plugin
≤0.1.1Update to 0.1.2
CVE-2017-18493Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
Contact Form Multi by BestWebSoft – Multiple Forms Plugin for Single WordPress Website
<1.2.1Update to 1.2.1
CVE-2017-18490Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
Updater by BestWebSoft
≤1.34Update to 1.35
CVE-2017-18565Apr 12, 2017
Medium6.1
Reflected Cross-Site Scripting
Visitors Online by BestWebSoft
<1.0.0Update to 1.0.0
CVE-2017-18537Apr 12, 2017
Medium6.1
ReflectedCross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<3.96Update to 3.96
CVE-2015-9295Apr 12, 2017
Medium6.1
Multiple Cross-Site Scripting
Subscriber by BestWebSoft
≤1.3.4Update to 1.3.5
CVE-2017-18502Apr 12, 2017
Medium6.1
Multiple Cross-Site Scripting
SMTP by BestWebSoft
≤1.0.9Update to 1.1.0
CVE-2017-18518Apr 12, 2017
Medium6.1
Multiple Cross-Site Scripting
Social Login by BestWebSoft
≤0.1Update to 0.2
CVE-2017-18501Apr 12, 2017
Medium6.1
Multiple Cross-Site Scripting
Analytics by BestWebSoft – Google Analytics Dashboard and Statistic Plugin for WordPress
≤1.7.0Update to 1.7.1
CVE-2017-18556Apr 12, 2017
Medium6.1
Cross-Site Scripting
Help Center by BestWebSoft
≤1.0.4Update to 1.0.5
CVE-2017-18542Apr 12, 2017
Medium6.1
Multiple Cross-Site Scripting
AdPush
≤1.43Update to 1.44
CVE-2017-18487Apr 12, 2017
Medium6.1
Cross-Site Scripting
BestWebSoft's Twitter
<2.55Update to 2.55
CVE-2017-18505Apr 12, 2017