Database
WordPress Vulnerability Database (page 1287)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.5 | Local File Inclusion | CVE-2020-11732 | — | |
| Medium5.8 | Authenticated Stored Cross-Site Scripting WordPress≤5.2.4Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1 | CVE-2019-16781 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1 | CVE-2019-20041 | — | |
| Medium5.8 | Stored Cross-Site Scripting via Block Editor WordPress≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1 | CVE-2019-16780 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1 | CVE-2019-20042 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-6030 | — | |
| Critical9.8 | Authentication Bypass | CVE-2019-25763 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-6029 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2019-19198 | — | |
| High8.8 | Authenticated Arbitrary Options Update | CVE-2019-25142 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-19133 | — | |
| Medium4.3 | Authorization Bypass WordPress≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1 | CVE-2019-20043 | — | |
| Medium6.1 | Bootstrap Admin Theme <= 2.0 - Cross-Site Scripting | CVE-2019-20141 | — | |
| Medium5.4 | WordPress Directory & Listing Theme < 2.0.14.5 - Stored Cross-Site Scripting | CVE-2019-19542 | — | |
| Medium6.1 | WordPress Directory & Listing Theme < 2.0.14.5 - Reflected Cross-Site Scripting | CVE-2019-19540 | — | |
| Medium5.4 | WordPress Directory & Listing Theme < 2.0.14.5 - Stored Cross-Site Scripting | CVE-2019-19541 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-6027 | — | |
| High8.8 | Cross-Site Request Forgery to Stored Cross-Site Scripting | CVE-2019-19979 | — | |
| Medium6.1 | Reflected Cross-Site Scripting via b2s_id Parameter | CVE-2019-17550 | — | |
| High8.3 | Unauthenticated Blind SQL Injection | CVE-2019-20361 | — | |
| Medium6.3 | Missing Authorization | CVE-2019-19984 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-17599 | — | |
| High7.8 | Remote Code Execution | CVE-2019-14467 | — | |
| Medium4.3 | Missing Authorization to Test Email | CVE-2019-19980 | — | |
| Medium5.8 | Unauthenticated File Download w/ Information Disclosure | CVE-2019-19985 | — | |
| Medium5.4 | Cross-Site Request Forgery on Settings | CVE-2019-19981 | — | |
| Medium6.5 | Unauthenticated Option Creation | CVE-2019-19982 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2019-14365 | — | |
| High8.6 | Sensitive Information Disclosure | CVE-2019-14366 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-17515 | — |
- High7.5Local File Inclusion
Media Library Assistant
≤2.81Update to 2.82
- Medium5.8Authenticated Stored Cross-Site Scripting
WordPress
≤5.2.4Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1
- Medium5.8Stored Cross-Site Scripting via Block Editor
WordPress
≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1
- High8.8Cross-Site Request Forgery
Custom Body Class
≤0.6.0Update to 0.7.0
- Critical9.8Authentication Bypass
Ultimate Addons for Beaver Builder
<1.24.0Update to 1.24.1
- Medium6.1Cross-Site Scripting
Custom Body Class
≤0.6.0Update to 0.7.0
- Medium6.4Cross-Site Scripting
Scoutnet Kalender
≤1.1.0No patch available
- High8.8Authenticated Arbitrary Options Update
Mesmerize
≤1.6.89Update to 1.6.90
- Medium6.1Reflected Cross-Site Scripting
CSS Hero
≤4.03Update to 4.07
- Medium4.3Authorization Bypass
WordPress
≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1
- Medium6.1Bootstrap Admin Theme <= 2.0 - Cross-Site Scripting
Neon - Bootstrap Admin Theme
≤2.0No patch available
- Medium5.4WordPress Directory & Listing Theme < 2.0.14.5 - Stored Cross-Site Scripting
ListingPro - WordPress Directory & Listing Theme
≤2.0.14.4Update to 2.0.14.5
- Medium6.1WordPress Directory & Listing Theme < 2.0.14.5 - Reflected Cross-Site Scripting
ListingPro - WordPress Directory & Listing Theme
<2.0.14.5Update to 2.0.14.5
- Medium5.4WordPress Directory & Listing Theme < 2.0.14.5 - Stored Cross-Site Scripting
ListingPro - WordPress Directory & Listing Theme
≤2.0.14.4Update to 2.0.14.5
- High8.8Cross-Site Request Forgery
WP Spell Check
≤7.1.9Update to 7.1.10
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Maintenance
≤5.0.5Update to 5.0.6
- Medium6.1Reflected Cross-Site Scripting via b2s_id Parameter
Blog2Social: Social Media Auto Post & Scheduler
<5.9.0Update to 5.9.0
- High8.3Unauthenticated Blind SQL Injection
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.3.0Update to 4.3.1
- Medium6.3Missing Authorization
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.2.2Update to 4.2.3
- Medium6.1Reflected Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤6.3.4Update to 6.3.5
- High7.8Remote Code Execution
Social Photo Gallery
≤1.0No patch available
- Medium4.3Missing Authorization to Test Email
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.2.2Update to 4.2.3
- Medium5.8Unauthenticated File Download w/ Information Disclosure
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.2.2Update to 4.2.3
- Medium5.4Cross-Site Request Forgery on Settings
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.2.2Update to 4.2.3
- Medium6.5Unauthenticated Option Creation
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.2.2Update to 4.2.3
- High7.5Sensitive Information Disclosure
WP Intercom - Slack for WordPress
≤1.2.1No patch available
- High8.6Sensitive Information Disclosure
wpslacksync
<1.8.6Update to 1.8.6
- Medium6.1Reflected Cross-Site Scripting
Anti-Spam, Spam FireWall by CleanTalk
≤5.127.3Update to 5.127.4