Database
WordPress Vulnerability Database (page 1282)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Cross-Site Scripting in the Block Editor WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11030 | — | |
| Medium6.1 | Password Reset Link Non-Expiration WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11027 | — | |
| Medium5.8 | Reflected Cross Site Scripting WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11029 | — | |
| Medium5.8 | Authenticated Cross-Site Scripting via Customizer WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11025 | — | |
| Medium5.8 | Private Post Disclosure WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11028 | — | |
| Medium4.3 | Redirect Security Bypass | CVE-2020-36699 | — | |
| High8.8 | SQL Injection | CVE-2020-12104 | — | |
| Medium6.1 | Cross-Site Request Forgery leading to Stored Cross-Site Scripting Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.4.24.2Update to 3.4.24.2 | CVE-2020-12462 | — | |
| High8.8 | Cross-Site Request Forgery to Stored Cross-Site Scripting | CVE-2020-13641 | — | |
| Medium6.4 | Authenticated (Contributor+) Cross-Site Scripting | CVE-2020-36711 | — | |
| High7.3 | Missing Authorization Checks | CVE-2020-36697 | — | |
| Medium5.3 | Information Disclosure | CVE-2020-12070 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2020-20628 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2020-12054 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2020-36703 | — | |
| High7.3 | Missing Authorization | CVE-2020-36840 | — | |
| High8.1 | Privilege Escalation via accept-to-be-teacher action parameter | CVE-2020-11511 | — | |
| Medium6.1 | Reflected Cross Site Scripting | CVE-2020-11930 | — | |
| High7.1 | Authenticated Page Creation and Status Modification | CVE-2020-11510 | — | |
| High7.4 | Unauthorized Widget Import to Stored Cross-Site Scripting | CVE-2020-36769 | — | |
| Critical9.8 | Missing Authorization | CVE-2020-11673 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-11727 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2020-11508 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2020-11509 | — | |
| High8.3 | Cross-Site Request Forgery | CVE-2020-36839 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2020-15535 | — | |
| High7.2 | Cross-Site Scripting | CVE-2020-15536 | — | |
| Medium6.1 | Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting | CVE-2020-15537 | — | |
| Critical9.8 | Unauthenticated Settings Update | CVE-2019-17230 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2019-17231 | — |
- Medium6.4Cross-Site Scripting in the Block Editor
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium6.1Password Reset Link Non-Expiration
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium5.8Reflected Cross Site Scripting
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium5.8Authenticated Cross-Site Scripting via Customizer
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium5.8Private Post Disclosure
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium4.3Redirect Security Bypass
Quick Page/Post Redirect Plugin
≤5.1.9Update to 5.2.0
- High8.8SQL Injection
WordPress WP-Advanced-Search
≤3.3.6Update to 3.3.7
- Medium6.1Cross-Site Request Forgery leading to Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.24.2Update to 3.4.24.2
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Real-Time Find and Replace
≤3.9Update to 4.0.2
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
Avada | Website Builder For WordPress & WooCommerce
<6.2.3Update to 6.2.3
- High7.3Missing Authorization Checks
WP GDPR
≤2.1.1No patch available
- Medium5.3Information Disclosure
Advanced Woo Search – Product Search for WooCommerce
≤1.99Update to 2.00
- Medium6.1Unauthenticated Stored Cross-Site Scripting
WP GDPR
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Catch Breadcrumb
<1.5.5Update to 1.5.5
- Medium6.4Authenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.7Update to 2.9.8
- High7.3Missing Authorization
Timetable and Event Schedule by MotoPress
≤2.3.8Update to 2.3.9
- High8.1Privilege Escalation via accept-to-be-teacher action parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- Medium6.1Reflected Cross Site Scripting
Translate WordPress with GTranslate
≤2.8.51Update to 2.8.52
- High7.1Authenticated Page Creation and Status Modification
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- High7.4Unauthorized Widget Import to Stored Cross-Site Scripting
Widget Settings Importer/Exporter
≤1.5.3No patch available
- Critical9.8Missing Authorization
TS Poll – Survey, Versus Poll, Image Poll, Video Poll
<1.3.4Update to 1.3.4
- Medium6.1Cross-Site Scripting
Advanced Order Export For WooCommerce
<3.1.4Update to 3.1.4
- Medium5.4Authenticated Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
<0.99Update to 0.99
- High7.2Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.98Update to 0.99
- High8.3Cross-Site Request Forgery
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.99No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Car Rental System
≤1.3No patch available
- High7.2Cross-Site Scripting
Online Hotel Booking System Pro
≤1.1No patch available
- Medium6.1Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting
Vanguard - Marketplace Digital Products PHP7
≤2.1No patch available
- Critical9.8Unauthenticated Settings Update
OneTone Companion
≤1.1.1No patch available
- High7.2Stored Cross-Site Scripting
OneTone Companion
≤1.1.1No patch available