Database
WordPress Vulnerability Database (page 1290)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting via custom-write-panel-id Parameter | CVE-2017-18609 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2019-12516 | — | |
| Medium6.1 | Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-group-id parameter | CVE-2017-18610 | — | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting | CVE-2019-25315 | — | |
| Critical9.8 | Stored Cross-Site Scripting via Import | CVE-2019-15896 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Read | CVE-2019-25213 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16118 | — | |
| Critical9.8 | SQL Injection | CVE-2019-16119 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16117 | — | |
| High7.5 | Arbitrary Settings Change | CVE-2019-15895 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16332 | — | |
| Medium6.4 | Cross-Site Scripting via Media Uploads WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16217 | — | |
| Medium6.1 | Reflected Cross-Site Scripting WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16221 | — | |
| Medium6.4 | Stored Cross-Site Scripting via Comments via URLs WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16222 | — | |
| Medium4.6 | Open Redirect WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16220 | — | |
| Medium5.4 | Authenticated Cross-Site Scripting via Post Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16223 | — | |
| High7.2 | Stored Cross-Site Scripting via Comments WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16218 | — | |
| Medium5.4 | Reflected Cross-Site Scripting via Shortcode Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16219 | — | |
| High8.8 | CSV Injection | CVE-2019-16120 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-1010124 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15769 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2019-15777 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14314 | 300K+ | |
| High7.5 | Unauthenticated Settings Change | CVE-2019-15816 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9352 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-14470 | — | |
| Medium5.3 | Improper Input Validation | CVE-2019-14978 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15770 | — | |
| High7.5 | Missing Authorization to Settings Update | CVE-2019-15821 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2019-15778 | — |
- Medium6.1Cross-Site Scripting via custom-write-panel-id Parameter
Magic Fields
≤1.7.1Update to 1.7.2
- High8.8Authenticated SQL Injection
SlickQuiz
≤1.3.7.1No patch available
- Medium6.1Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-group-id parameter
Magic Fields
≤1.7.1Update to 1.7.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Server Log Viewer
≤1.0No patch available
- Critical9.8Stored Cross-Site Scripting via Import
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<3.35.0Update to 3.35.0
- Critical9.8Unauthenticated Arbitrary File Read
Access Governance for WordPress (aka AAM)
<5.9.9Update to 5.9.9
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.34Update to 1.5.35
- Critical9.8SQL Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.35Update to 1.5.35
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.35Update to 1.5.35
- High7.5Arbitrary Settings Change
Search Exclude
<1.2.4Update to 1.2.4
- Medium6.1Cross-Site Scripting
API Bearer Auth
<20190907Update to 20190907
- Medium6.4Cross-Site Scripting via Media Uploads
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.1Reflected Cross-Site Scripting
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.4Stored Cross-Site Scripting via Comments via URLs
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium4.6Open Redirect
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium5.4Authenticated Cross-Site Scripting via Post Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- High7.2Stored Cross-Site Scripting via Comments
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium5.4Reflected Cross-Site Scripting via Shortcode Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- High8.8CSV Injection
Event Tickets and Registration
≤4.10.7.1Update to 4.10.7.2
- Medium6.1Reflected Cross-Site Scripting
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤3.1.14Update to 3.1.15
- High8.8Cross-Site Request Forgery
HandL UTM Grabber / Tracker
<2.6.5Update to 2.6.5
- Medium5.4Cross-Site Scripting
WP DSGVO Tools (GDPR)
<2.2.19Update to 2.2.19
- Critical9.8SQL Injection
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<3.2.11Update to 3.2.11
- High7.5Unauthenticated Settings Change
WP Private Content Plus
≤1.31Update to 2.0
- Critical9.8SQL Injection
WP-Polls
≤2.71Update to 2.72
- Medium6.1Reflected Cross-Site Scripting
UserPro - Community and User Profile WordPress Plugin
≤4.9.34Update to 4.9.35.1
- Medium5.3Improper Input Validation
WooCommerce PayU India (PayUmoney – PayUbiz)
≤2.1.1No patch available
- High8.8Cross-Site Request Forgery
Address Book for WooCommerce
<1.6.0Update to 1.6.0
- High7.5Missing Authorization to Settings Update
Bold Page Builder
≤2.3.1Update to 2.3.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Additional Variation Images Gallery for WooCommerce
<1.1.29Update to 1.2.29