Database
WordPress Vulnerability Database (page 1280)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2020-26672 | — | |
| Medium6.1 | Real Estate WordPress Theme < 1.8 - Cross-Site Scripting | CVE-2020-15364 | — | |
| Critical9.8 | Real Estate WordPress Theme <= 1.7 - SQL Injection | CVE-2020-15363 | — | |
| Medium6.5 | All Comments Deletion via Cross-Site Request Forgery | CVE-2020-36505 | — | |
| High8.8 | Authorization Bypass due to Improper Access Control | CVE-2020-36700 | — | |
| High8.8 | Arbitrary File Upload | CVE-2020-36701 | — | |
| Critical9.8 | wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter | CVE-2020-13640 | — | |
| Medium6.8 | Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4047 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4046 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-36172 | — | |
| Medium5.3 | Comment Disclosure WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-25286 | — | |
| Low3.5 | Arbitrary User Meta Update WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4050 | — | |
| Low2.4 | Self-Cross Site Scripting via Theme Folder Name WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4049 | — | |
| Medium5.7 | Open Redirect WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4048 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2020-13892 | — | |
| High7.2 | Admin+ SQL Injection | CVE-2020-35012 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-35037 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-13864 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-13865 | — | |
| Critical9.8 | Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload | CVE-2020-12800 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2021-24138 | — | |
| High7.1 | Reflected Cross-Site Scripting | CVE-2022-1168 | — | |
| High7.4 | Authorization Bypass to Settings Updates | CVE-2020-36714 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2022-1169 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2019-20182 | — | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload | CVE-2022-1939 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2021-24137 | — | |
| High7.3 | Authenticated CSV Injection | CVE-2020-36503 | — | |
| High7.5 | Insecure direct object reference via permalinks manipulation | CVE-2020-13700 | — | |
| Critical9.8 | Unauthenticated Privilege Escalation | CVE-2020-13693 | — |
- Medium6.4Authenticated Stored Cross-Site Scripting
Testimonial Rotator
<3.0.3No patch available
- Medium6.1Real Estate WordPress Theme < 1.8 - Cross-Site Scripting
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Critical9.8Real Estate WordPress Theme <= 1.7 - SQL Injection
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Medium6.5All Comments Deletion via Cross-Site Request Forgery
Delete All Comments Easily
≤1.3No patch available
- High8.8Authorization Bypass due to Improper Access Control
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4
- High8.8Arbitrary File Upload
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4
- Critical9.8wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter
Comments – wpDiscuz
<5.3.6Update to 5.3.6
- Medium6.8Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium5.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium6.1Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.8.12Update to 5.8.12
- Medium5.3Comment Disclosure
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Low3.5Arbitrary User Meta Update
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Low2.4Self-Cross Site Scripting via Theme Folder Name
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium5.7Open Redirect
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium5.4Cross-Site Scripting
SportsPress – Sports Club & League Manager
<2.7.2Update to 2.7.2
- High7.2Admin+ SQL Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
- Medium5.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9
- Medium5.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9
- Critical9.8Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.3.2Update to 1.3.3.3
- High7.2Authenticated SQL Injection
AdRotate Banner Manager
<5.8.4Update to 5.8.4
- High7.1Reflected Cross-Site Scripting
JobSearch WP Job Board
<1.5.1Update to 1.5.1
- High7.4Authorization Bypass to Settings Updates
Brizy – Page Builder
<1.0.126Update to 1.0.126
- Medium6.1Cross-Site Scripting
Careerfy - Job Board WordPress Theme
<3.9.0Update to 3.9.0
- Medium4.8Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤1.8.12Update to 1.8.18
- High7.2Authenticated (Admin+) Arbitrary File Upload
Allow svg files
<1.1Update to 1.1
- High8.8Authenticated SQL Injection
Blog2Social: Social Media Auto Post & Scheduler
≤6.3.0Update to 6.3.1
- High7.3Authenticated CSV Injection
Connections Business Directory
≤9.6Update to 9.7
- High7.5Insecure direct object reference via permalinks manipulation
ACF to REST API
≤3.2.0Update to 3.3.0
- Critical9.8Unauthenticated Privilege Escalation
bbPress
≤2.6.4Update to 2.6.5