Database
WordPress Vulnerability Database (page 1289)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Authorization Bypass WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17671 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-20626 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9508 | — | |
| Medium5.4 | Server Side Request Forgery WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17669 | — | |
| Medium5.4 | Server Side Request Forgery #2 WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17670 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17672 | — | |
| High7.5 | Unauthenticated Arbitrary File Deletion | CVE-2019-16902 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-17070 | — | |
| High8.0 | Authenticated (Admin+) SQL Injection | CVE-2019-17072 | — | |
| Medium5.5 | Authenticated (Admin+) Cross-Site Scripting | CVE-2019-17071 | — | |
| High7.2 | Missing Authorization to Stored Cross-Site Scripting | CVE-2019-25214 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2019-17239 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2017-14760 | — | |
| Critical9.3 | Server-Side Request Forgery | CVE-2019-16932 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-16931 | — | |
| High7.5 | Authorization Bypass | CVE-2019-20360 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2019-16524 | — | |
| Medium6.1 | Real Estate WordPress Theme < 4.2 - Cross-Site Scripting | CVE-2019-25742 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2019-25216 | — | |
| High7.2 | Stored Cross Site Scripting | CVE-2019-25146 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-17229 | — | |
| Medium6.5 | Unauthenticated Settings Import/Export | CVE-2019-17228 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-17233 | — | |
| Critical9.1 | Unauthenticated Options Import/Export | CVE-2019-17232 | — | |
| High7.4 | CSV Injection | CVE-2020-9466 | — | |
| Medium6.4 | Authenticated Cross-Site Scripting | CVE-2019-16289 | — | |
| Medium5.3 | Information Disclosure | CVE-2019-14936 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16525 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-12517 | — | |
| Medium6.1 | Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-field-css parameter | CVE-2017-18611 | — |
- Medium5.3Authorization Bypass
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.4Stored Cross-Site Scripting
Lara's Google Analytics (GA4)
<2.0.5Update to 2.0.5
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – Commissions
≤3.1.2Update to 3.1.3
- Medium5.4Server Side Request Forgery
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.4Server Side Request Forgery #2
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- High7.5Unauthenticated Arbitrary File Deletion
ARforms
≤3.7.1Update to 4.0
- Medium6.1Cross-Site Scripting
LIQUID SPEECH BALLOON
<1.0.7Update to 1.0.7
- High8.0Authenticated (Admin+) SQL Injection
Contact Form Widget – Responsive Contact Form, Query Form & Form Builder
≤1.3.8Update to 1.3.9
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Client Dash
≤2.2.0No patch available
- High7.2Missing Authorization to Stored Cross-Site Scripting
ShopWP
≤2.0.4Update to 2.0.5
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Download Plugins and Themes in ZIP from Dashboard
<1.6.0Update to 1.6.0
- Critical9.8Unauthenticated SQL Injection
Event Expresso Free
≤3.1.37.12Update to 3.1.37.14 or 3.1.37.14L
- Critical9.3Server-Side Request Forgery
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.3.0Update to 3.3.1
- Medium6.1Stored Cross-Site Scripting
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.3.0Update to 3.3.1
- High7.5Authorization Bypass
GiveWP – Donation Plugin and Fundraising Platform
≤2.5.4Update to 2.5.5
- Medium5.5Authenticated Stored Cross-Site Scripting
Firelight Lightbox
≤1.8.17Update to 1.8.18
- Medium6.1Real Estate WordPress Theme < 4.2 - Cross-Site Scripting
Zoner - Real Estate WordPress Theme
<4.2Update to 4.2
- High7.2Stored Cross-Site Scripting
Rich Reviews by Starfish
≤1.7.4Update to 1.8.0
- High7.2Stored Cross Site Scripting
DELUCKS SEO
≤2.1.7Update to 2.1.8
- Medium6.1Stored Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
<1.4.1Update to 1.4.1
- Medium6.5Unauthenticated Settings Import/Export
Motors – Car Dealership & Classified Listings Plugin
<1.4.1Update to 1.4.1
- Medium6.1Cross-Site Scripting
Ultimate FAQ Accordion Plugin
<1.8.25Update to 1.8.25
- Critical9.1Unauthenticated Options Import/Export
Ultimate FAQ Accordion Plugin
<1.8.25Update to 1.8.25
- High7.4CSV Injection
Export Users to CSV
<1.4Update to 1.4
- Medium6.4Authenticated Cross-Site Scripting
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
<2.2.9Update to 2.2.9
- Medium5.3Information Disclosure
Easy!Appointments
≤1.3.2Update to 1.4.0
- Medium6.1Cross-Site Scripting
Checklist
≤1.1.8Update to 1.1.9
- Medium6.1Stored Cross-Site Scripting
SlickQuiz
≤1.3.7.1No patch available
- Medium6.1Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-field-css parameter
Magic Fields
≤1.7.1Update to 1.7.2