Database

WordPress Vulnerability Database (page 1275)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1275)
Severity	Vulnerability	CVE	Installs	Published
High7.3	CSV injection via a customer's profile Import and export users and customers≤1.16.3.5Update to 1.16.3.6	CVE-2020-22277	—	Nov 20, 2020
High8.8	CSV Injection Easy Registration Forms≤2.0.6No patch available	CVE-2020-22275	—	Nov 20, 2020
High7.2	Authenticated SQL Injection Anti-Spam, Spam FireWall by CleanTalk<5.149Update to 5.149	CVE-2021-24131	—	Nov 20, 2020
Critical9.8	Unauthenticated Arbitrary File Upload AIT CSV import/export≤3.0.3Update to 3.0.4	CVE-2020-36849	—	Nov 13, 2020
Critical9.8	Unauthenticated SQL Injection Good LMS - Learning Management System WP Plugin≤2.1.4Update to 2.1.5	CVE-2020-27481	—	Nov 12, 2020
Critical9.8	PHP Object Injection Ultimate Reviews<2.1.33Update to 2.1.33	CVE-2020-36726	—	Nov 10, 2020
Critical10.0	Unauthenticated Privilege Escalation via User Roles Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.1.12Update to 2.1.12	CVE-2020-36157	—	Nov 9, 2020
Critical10.0	Unauthenticated Privilege Escalation via User Meta Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.1.12Update to 2.1.12	CVE-2020-36155	—	Nov 9, 2020
Critical9.9	Authenticated Privilege Escalation via Profile Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<2.1.12Update to 2.1.12	CVE-2020-36156	—	Nov 9, 2020
High7.5	PHP Object Injection Welcart e-Commerce<1.9.36Update to 1.9.36	CVE-2020-28339	—	Nov 5, 2020
Critical9.8	PHP Object Injection GDPR CCPA Compliance & Cookie Consent Banner≤2.3Update to 2.4	CVE-2020-36718	—	Nov 3, 2020
Critical9.8	Remote Code Execution Simple File List<4.2.3Update to 4.2.3	CVE-2020-36847	—	Nov 2, 2020
High8.8	Author+ SQL Injection AccessPress Social Icons<1.8.1Update to 1.8.1	CVE-2021-24143	—	Nov 2, 2020
High8.8	Privilege Escalation via XML-RPC WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2	CVE-2020-28036	—	Oct 29, 2020
Medium6.1	Reflected Cross-Site Scripting via Global Variables WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2	CVE-2020-28034	—	Oct 29, 2020
High8.8	Deserialization Gadget WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2	CVE-2020-28032	—	Oct 29, 2020
Critical9.8	PHP Object Injection Gadget WordPress<5.5.3Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.8 or 5.2.9 or 5.3.6 or 5.4.4 or 5.5.3	CVE-2021-29476	—	Oct 29, 2020
Medium4.3	Cross-Site Request Forgery to Theme Image Change WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2	CVE-2020-28040	—	Oct 29, 2020
Medium6.4	Stored Cross-Site Scripting via post slugs WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2	CVE-2020-28038	—	Oct 29, 2020
Medium4.8	Misconfiguration That Allows Trigger of New Installation WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2	CVE-2020-28037	—	Oct 29, 2020
Medium5.4	Arbitrary File Deletion WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2	CVE-2020-28039	—	Oct 29, 2020
Medium4.3	Spam Embed on Multisite Installations WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2	CVE-2020-28033	—	Oct 29, 2020
High8.8	Privilege Escalation via XML-RPC WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2	CVE-2020-28035	—	Oct 29, 2020
Medium5.5	Authenticated Stored Cross-Site Scripting CM Download Manager – Organize, Protect & Share Files in WordPress<2.8.0Update to 2.8.0	CVE-2020-27344	—	Oct 22, 2020
Medium6.1	Unauthenticated Stored Cross-Site Scripting Simple Download Monitor≤3.3.8Update to 3.3.9	CVE-2020-5650	—	Oct 21, 2020
Critical9.8	SQL Injection Loginizer<1.6.4Update to 1.6.4	CVE-2020-27615	—	Oct 21, 2020
High8.8	SQL Injection Simple Download Monitor≤3.8.8Update to 3.8.9	CVE-2020-5651	—	Oct 21, 2020
Medium5.4	Stored Cross-Site Scripting Debug Meta Data≤1.1.2No patch available	CVE-2020-27356	—	Oct 20, 2020
Medium6.1	Reflected Cross-Site Scripting Stockdio Historical Chart<2.8.1Update to 2.8.1	CVE-2020-28707	—	Oct 19, 2020
High8.8	Arbitrary Options Update TI WooCommerce Wishlist≤1.21.11Update to 1.21.12	CVE-2020-36725	—	Oct 16, 2020

High7.3
CSV injection via a customer's profile
Import and export users and customers
≤1.16.3.5Update to 1.16.3.6
CVE-2020-22277Nov 20, 2020
High8.8
CSV Injection
Easy Registration Forms
≤2.0.6No patch available
CVE-2020-22275Nov 20, 2020
High7.2
Authenticated SQL Injection
Anti-Spam, Spam FireWall by CleanTalk
<5.149Update to 5.149
CVE-2021-24131Nov 20, 2020
Critical9.8
Unauthenticated Arbitrary File Upload
AIT CSV import/export
≤3.0.3Update to 3.0.4
CVE-2020-36849Nov 13, 2020
Critical9.8
Unauthenticated SQL Injection
Good LMS - Learning Management System WP Plugin
≤2.1.4Update to 2.1.5
CVE-2020-27481Nov 12, 2020
Critical9.8
PHP Object Injection
Ultimate Reviews
<2.1.33Update to 2.1.33
CVE-2020-36726Nov 10, 2020
Critical10.0
Unauthenticated Privilege Escalation via User Roles
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.12Update to 2.1.12
CVE-2020-36157Nov 9, 2020
Critical10.0
Unauthenticated Privilege Escalation via User Meta
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.12Update to 2.1.12
CVE-2020-36155Nov 9, 2020
Critical9.9
Authenticated Privilege Escalation via Profile Update
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.12Update to 2.1.12
CVE-2020-36156Nov 9, 2020
High7.5
PHP Object Injection
Welcart e-Commerce
<1.9.36Update to 1.9.36
CVE-2020-28339Nov 5, 2020
Critical9.8
PHP Object Injection
GDPR CCPA Compliance & Cookie Consent Banner
≤2.3Update to 2.4
CVE-2020-36718Nov 3, 2020
Critical9.8
Remote Code Execution
Simple File List
<4.2.3Update to 4.2.3
CVE-2020-36847Nov 2, 2020
High8.8
Author+ SQL Injection
AccessPress Social Icons
<1.8.1Update to 1.8.1
CVE-2021-24143Nov 2, 2020
High8.8
Privilege Escalation via XML-RPC
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
CVE-2020-28036Oct 29, 2020
Medium6.1
Reflected Cross-Site Scripting via Global Variables
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
CVE-2020-28034Oct 29, 2020
High8.8
Deserialization Gadget
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
CVE-2020-28032Oct 29, 2020
Critical9.8
PHP Object Injection Gadget
WordPress
<5.5.3Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.8 or 5.2.9 or 5.3.6 or 5.4.4 or 5.5.3
CVE-2021-29476Oct 29, 2020
Medium4.3
Cross-Site Request Forgery to Theme Image Change
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
CVE-2020-28040Oct 29, 2020
Medium6.4
Stored Cross-Site Scripting via post slugs
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
CVE-2020-28038Oct 29, 2020
Medium4.8
Misconfiguration That Allows Trigger of New Installation
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
CVE-2020-28037Oct 29, 2020
Medium5.4
Arbitrary File Deletion
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
CVE-2020-28039Oct 29, 2020
Medium4.3
Spam Embed on Multisite Installations
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
CVE-2020-28033Oct 29, 2020
High8.8
Privilege Escalation via XML-RPC
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
CVE-2020-28035Oct 29, 2020
Medium5.5
Authenticated Stored Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
CVE-2020-27344Oct 22, 2020
Medium6.1
Unauthenticated Stored Cross-Site Scripting
Simple Download Monitor
≤3.3.8Update to 3.3.9
CVE-2020-5650Oct 21, 2020
Critical9.8
SQL Injection
Loginizer
<1.6.4Update to 1.6.4
CVE-2020-27615Oct 21, 2020
High8.8
SQL Injection
Simple Download Monitor
≤3.8.8Update to 3.8.9
CVE-2020-5651Oct 21, 2020
Medium5.4
Stored Cross-Site Scripting
Debug Meta Data
≤1.1.2No patch available
CVE-2020-27356Oct 20, 2020
Medium6.1
Reflected Cross-Site Scripting
Stockdio Historical Chart
<2.8.1Update to 2.8.1
CVE-2020-28707Oct 19, 2020
High8.8
Arbitrary Options Update
TI WooCommerce Wishlist
≤1.21.11Update to 1.21.12
CVE-2020-36725Oct 16, 2020