Database
Critical WordPress vulnerabilities (page 1317)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18557 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2017-18556 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18542 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-17946 | — | |
| Critical9.8 | SQL Injection | CVE-2017-7719 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-8099 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2017-8100 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18504 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18503 | — | |
| Medium6.1 | All In One Schema Rich Snippets <= 1.4.4 - Cross-Site Scripting | CVE-2018-20977 | — | |
| Critical9.8 | Blind SQL Injection via imgid | CVE-2017-1002013 | — | |
| Critical9.8 | SQL Injection via gid | CVE-2017-1002012 | — | |
| Critical9.8 | SQL Injection via selectMulGallery | CVE-2017-1002015 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2017-1002011 | — | |
| Critical9.8 | SQL Injection via gallery_name | CVE-2017-1002014 | — | |
| High8.2 | Open Proxy | CVE-2015-1000002 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-2127 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18544 | — | |
| High7.5 | Email Injection | CVE-2017-18543 | — | |
| High7.5 | Improper Input Validation | CVE-2017-18545 | — | |
| Critical9.8 | SQL Injection | CVE-2017-18571 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002009 | — | |
| Medium5.3 | Change of Email Invitation Content | CVE-2017-6955 | — | |
| Medium4.3 | Authorization Bypass | CVE-2017-6954 | — | |
| High8.8 | SQL Injection | CVE-2017-1002010 | — | |
| Critical9.8 | Arbitrary File Download | CVE-2017-1002008 | — | |
| High7.5 | Missing Authorization | CVE-2017-1002006 | — | |
| Critical9.8 | SQL Injection | CVE-2017-20247 | — | |
| High7.2 | SQL Injection via subscriber_email parameter | CVE-2017-6578 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002004 | — |
- Medium6.1Reflected Cross-Site Scripting
Maps by BestWebSoft
≤1.3.5Update to 1.3.6
- Medium6.1Multiple Cross-Site Scripting
Analytics by BestWebSoft – Google Analytics Dashboard and Statistic Plugin for WordPress
≤1.7.0Update to 1.7.1
- Medium6.1Cross-Site Scripting
Help Center by BestWebSoft
≤1.0.4Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting
Slideshow Gallery LITE
≤1.6.5Update to 1.6.6
- Critical9.8SQL Injection
SpiderCalendar
≤1.5.51Update to 1.5.52
- High8.8Cross-Site Request Forgery
WHIZZ
≤1.1Update to 1.1.1
- Medium6.5Cross-Site Request Forgery
CopySafe Web Protection – Copy Protect Images
<2.6Update to 2.6
- High8.8Cross-Site Request Forgery
Twitter Cards Meta – Best Twitter Card Plugin for WordPress
≤2.4.5Update to 2.5.0
- Medium6.1Cross-Site Scripting
Twitter Cards Meta – Best Twitter Card Plugin for WordPress
<2.5.0Update to 2.5.0
- Medium6.1All In One Schema Rich Snippets <= 1.4.4 - Cross-Site Scripting
Schema – All In One Schema Rich Snippets
<1.5.0Update to 1.5.0
- Critical9.8Blind SQL Injection via imgid
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- Critical9.8SQL Injection via gid
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- Critical9.8SQL Injection via selectMulGallery
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- Medium5.4Stored Cross-Site Scripting
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- Critical9.8SQL Injection via gallery_name
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
- High8.2Open Proxy
filedownload
≤1.4Update to 2.0
- Medium6.1Reflected Cross-Site Scripting
YOP Poll
<5.8.1Update to 5.8.1
- High8.8Cross-Site Request Forgery
Invite Anyone
<1.3.16Update to 1.3.16
- High7.5Email Injection
Invite Anyone
<1.3.16Update to 1.3.16
- High7.5Improper Input Validation
Invite Anyone
≤1.3.15Update to 1.3.16
- Critical9.8SQL Injection
Search Everything
≤8.1.6Update to 8.1.7
- Critical9.8SQL Injection
Membership Simplified
≤1.58No patch available
- Medium5.3Change of Email Invitation Content
Invite Anyone
<1.3.15Update to 1.3.15
- Medium4.3Authorization Bypass
BuddyPress Docs
<1.9.3Update to 1.9.3
- High8.8SQL Injection
Membership Simplified
<1.58Update to 1.58
- Critical9.8Arbitrary File Download
Membership Simplified
≤1.58No patch available
- High7.5Missing Authorization
DTracker
≤1.5No patch available
- Critical9.8SQL Injection
PICA Photo Gallery
≤1.0No patch available
- High7.2SQL Injection via subscriber_email parameter
Mail Masta
≤1.0No patch available
- Critical9.8SQL Injection
DTracker
≤1.5No patch available