Database
Critical WordPress vulnerabilities (page 1318)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.5 | Authorization Bypass | CVE-2017-1002007 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002004 | — | |
| Medium6.1 | HTML Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.0.31Update to 3.0.31 | CVE-2017-18574 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002001 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002003 | — | |
| Medium6.4 | Cross-Site Scripting via Taxonomy names WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6818 | — | |
| Medium4.9 | Arbitrary File Deletion WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6816 | — | |
| Medium6.1 | Bypass URL Validation WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6815 | — | |
| Medium6.4 | Authenticated Cross-Site Scripting in Youtube URL Embeds WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6817 | — | |
| High8.8 | Cross-Site Request Forgery via Press This WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6819 | — | |
| Medium6.4 | Cross-Site Scripting via Media Metadata WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6814 | — | |
| High7.2 | SQL Injection via filter_list | CVE-2017-6574 | — | |
| High7.2 | SQL Injection via id parameter | CVE-2017-6576 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2017-6102 | — | |
| Critical9.8 | Security Bypass to Database Login | CVE-2017-20066 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2017-20055 | — | |
| Medium6.1 | Cross-Site Scripting via Cross-Site Request Forgery | CVE-2024-27948 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2017-18572 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-20090 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-20054 | — | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting | CVE-2017-20056 | — | |
| Medium5.3 | Missing Authorization | CVE-2017-1002000 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-20053 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002002 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2017-18575 | — | |
| Critical9.8 | Unauthenticated PHP Object Injection | — | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2017-1000038 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-6104 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18615 | — | |
| High8.1 | Blind SQL Injection | CVE-2017-18614 | — |
- High7.5Authorization Bypass
DTracker
≤1.5No patch available
- Critical9.8SQL Injection
DTracker
≤1.5No patch available
- Medium6.1HTML Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.0.31Update to 3.0.31
- Critical9.8Arbitrary File Upload
Mobile App Builder by WapPress
≤1.05No patch available
- Critical9.8Arbitrary File Upload
Wp2android
≤1.1.4No patch available
- Medium6.4Cross-Site Scripting via Taxonomy names
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium4.9Arbitrary File Deletion
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.1Bypass URL Validation
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Authenticated Cross-Site Scripting in Youtube URL Embeds
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- High8.8Cross-Site Request Forgery via Press This
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Cross-Site Scripting via Media Metadata
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- High7.2SQL Injection via filter_list
Mail Masta
≤1.0No patch available
- High7.2SQL Injection via id parameter
Mail Masta
≤1.0No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
wordpress plugin rockhoist-badges
≤1.2.2No patch available
- Critical9.8Security Bypass to Database Login
adminer
≤1.4.5No patch available
- Medium6.4Stored Cross-Site Scripting
Contact Form Plugin
≤4.0.1Update to 4.0.2
- Medium6.1Cross-Site Scripting via Cross-Site Request Forgery
Atahualpa
≤3.7.24No patch available
- High7.2Stored Cross-Site Scripting
GNUCommerce
<1.4.2Update to 1.4.2
- High8.8Cross-Site Request Forgery
Global Content Blocks
≤2.1.5No patch available
- Medium6.1Cross-Site Scripting
Contact Form Manager
≤1.4.3Update to 1.4.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
User Login Log
≤2.2.2No patch available
- Medium5.3Missing Authorization
How to Create an App for Android iPhone Easytouch
≤3.0No patch available
- High8.8Cross-Site Request Forgery
Contact Form Manager
≤1.4.3Update to 1.4.4
- Critical9.8Arbitrary File Upload
webapp-builder
≤2.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
NewStatPress
<1.2.5Update to 1.2.5
- Critical9.8Unauthenticated PHP Object Injection
Analytics Stats Counter Statistics
≤1.2.2.5No patch available
- Medium6.1Stored Cross-Site Scripting
Relevanssi – A Better Search
<3.5.8Update to 3.5.8
- Critical9.8Arbitrary File Upload
Wordpress Plugin Mobile App Native 3.0
3.0 – 3.0No patch available
- Medium6.1Cross-Site Scripting
Kama Click Counter
≤3.4.9Update to 3.5.0
- High8.1Blind SQL Injection
Kama Click Counter
≤3.4.9Update to 3.5.0