Database
WordPress Vulnerability Database (page 1288)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-17236 | — | |
| High7.5 | Unauthenticated Arbitrary File Deletion | CVE-2019-17234 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-17237 | — | |
| Medium5.3 | Information Disclosure | CVE-2019-17235 | — | |
| Medium5.4 | Arbitrary Plugin Activation | CVE-2019-25151 | — | |
| Medium6.5 | Denial of Service | CVE-2019-18855 | — | |
| Medium6.5 | Denial of Service | CVE-2019-18854 | — | |
| Medium6.5 | Authorization Bypass | CVE-2019-18668 | — | |
| Medium4.3 | Authenticated Settings Change | CVE-2019-16251 | — | |
| Medium5.3 | Missing Authorization to Settings Update | CVE-2020-20627 | — | |
| Medium4.4 | Authenticated (Subscriber+) CSV Injection | CVE-2019-17661 | — | |
| High8.8 | Arbitrary File Upload | CVE-2020-7055 | — | |
| Medium5.4 | HTML injection | CVE-2019-25144 | — | |
| Medium6.1 | HTML Injection | CVE-2019-25148 | — | |
| High8.8 | HTML Injection | CVE-2019-25150 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2022-1170 | — | |
| High7.5 | Authenticated SQL Injection | CVE-2020-20625 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2019-16520 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2019-16523 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2019-16522 | — | |
| High7.2 | SQL injection | CVE-2019-6012 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-6011 | — | |
| Medium4.3 | Full Path Disclosure | CVE-2019-19983 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-16521 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-19306 | — | |
| Medium5.5 | Type Confusion WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17675 | — | |
| High7.3 | Cache Poisoning WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17673 | — | |
| Medium5.4 | Reflected Cross-Site Scripting | CVE-2019-17207 | — | |
| High7.5 | Unauthenticated information disclosure | CVE-2019-17574 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting via Customizer WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17674 | — |
- Medium6.1Stored Cross-Site Scripting
IgniteUp – Coming Soon and Maintenance Mode
<3.4.1Update to 3.4.1
- High7.5Unauthenticated Arbitrary File Deletion
IgniteUp – Coming Soon and Maintenance Mode
<3.4.1Update to 3.4.1
- High8.8Cross-Site Request Forgery
IgniteUp – Coming Soon and Maintenance Mode
≤3.4.0Update to 3.4.1
- Medium5.3Information Disclosure
IgniteUp – Coming Soon and Maintenance Mode
≤3.4.0Update to 3.4.1
- Medium5.4Arbitrary Plugin Activation
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤1.3.0Update to 1.3.1
- Medium6.5Denial of Service
Safe SVG
≤1.9.4Update to 1.9.5
- Medium6.5Denial of Service
Safe SVG
≤1.9.4Update to 1.9.5
- Medium6.5Authorization Bypass
Currency Switcher for WooCommerce
<2.11.2Update to 2.11.2
- Medium4.3Authenticated Settings Change
YITH WooCommerce Wishlist
≤2.2.13Update to 2.2.14
- Medium5.3Missing Authorization to Settings Update
GiveWP – Donation Plugin and Fundraising Platform
<2.5.10Update to 2.5.10
- Medium4.4Authenticated (Subscriber+) CSV Injection
Admin Columns Pro
≤6.4.9Update to 6.4.10
- High8.8Arbitrary File Upload
Elementor Website Builder – more than just a page builder
<2.7.5Update to 2.7.5
- Medium5.4HTML injection
WP Email Template
<2.2.11Update to 2.2.11
- Medium6.1HTML Injection
Email Template Designer – WP HTML Mail
<2.9.1Update to 2.9.1
- High8.8HTML Injection
Email Templates Customizer and Designer for WordPress and WooCommerce
≤1.3Update to 1.3.1
- Medium6.1Reflected Cross-Site Scripting
Noo JobMonster
<4.5.2.9Update to 4.5.2.9
- High7.5Authenticated SQL Injection
Sliced Invoices – WordPress Invoice Plugin
<3.8.4Update to 3.8.4
- Medium6.4Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤3.2.6Update to 3.2.7
- Medium6.4Authenticated Stored Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.5Update to 5.9.6
- Medium5.5Authenticated Stored Cross-Site Scripting
EU Cookie Law for GDPR/CCPA
<3.1.3Update to 3.1.3
- High7.2SQL injection
wpDataTables (Premium)
≤2.0.11Update to 2.0.12
- Medium6.1Cross-Site Scripting
wpDataTables (Premium)
≤2.0.11Update to 2.0.12
- Medium4.3Full Path Disclosure
Fast Velocity Minify
≤2.7.6Update to 2.7.7
- Medium6.1Reflected Cross-Site Scripting
Broken Link Checker
<1.11.9Update to 1.11.9
- Medium6.1Reflected Cross-Site Scripting
Zoho CRM Lead Magnet
<1.6.9.2Update to 1.6.9.2
- Medium5.5Type Confusion
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- High7.3Cache Poisoning
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.4Reflected Cross-Site Scripting
Broken Link Checker
<1.11.9Update to 1.11.9
- High7.5Unauthenticated information disclosure
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.8.12Update to 1.8.13
- Medium5.5Authenticated Stored Cross-Site Scripting via Customizer
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4