Database
WordPress Vulnerability Database (page 1299)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Local File Inclusion | CVE-2019-15322 | — | |
| Critical9.8 | Social Media API Key Leakage <= 1.7.1 - Information Exposure | CVE-2018-20555 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-6267 | — | |
| High8.8 | Cross-Site Request Forgery and Local File Inclusion | CVE-2019-15113 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2018-16206 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-6117 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2018-25436 | — | |
| Medium6.1 | Cross-Site Request Forgery | CVE-2019-1000003 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2024-51792 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20462 | — | |
| Critical9.8 | SQL Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.21.1Update to 3.3.21.2 | CVE-2019-15025 | — | |
| High8.8 | SQL injection | CVE-2018-20556 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2018-20463 | — | |
| Medium5.5 | Authenticated Cross-Site Scripting | CVE-2018-16204 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20968 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20231 | — | |
| Critical9.1 | Remote Code Execution | CVE-2018-20156 | — | |
| Medium5.5 | Cross-Site Scripting | CVE-2018-5668 | — | |
| High8.8 | PHP Object Injection WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20148 | — | |
| Medium6.4 | Stored Cross-Site Scripting via File Uploads WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20149 | — | |
| High7.7 | Arbitrary File Deletion WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20147 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting via Comments WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20153 | — | |
| Medium4.3 | Authorization Bypass WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20152 | — | |
| High7.5 | Sensitive Information Disclosure WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20151 | — | |
| Medium6.1 | WordPress Core < 5.0.1 Reflected Cross-Site Scripting WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20150 | — | |
| Medium6.1 | Import Cross-Site Scripting | CVE-2018-20101 | — | |
| High7.5 | Arbitrary File Read | CVE-2019-15330 | — | |
| Medium5.4 | Author+ Stored Cross-Site Scripting | CVE-2018-20986 | — | |
| High8.8 | Authenticated SQL Injection via Settings Import | CVE-2019-15872 | — | |
| Critical9.8 | Local File Inclusion | CVE-2018-20985 | — |
- Critical9.8Local File Inclusion
Shortcode Factory
≤2.7Update to 2.8
- Critical9.8Social Media API Key Leakage <= 1.7.1 - Information Exposure
Social Network Tabs
≤1.7.1No patch available
- Medium6.1Cross-Site Scripting
Easy Redirect Manager
≤2.18.18No patch available
- High8.8Cross-Site Request Forgery and Local File Inclusion
Companion Sitemap Generator – Simple, Smart, and SEO-Ready
≤3.6.6Update to 3.7.0
- Medium6.1Unauthenticated Cross-Site Scripting
spam-byebye
≤2.2.1Update to 2.2.2
- Medium6.1Stored Cross-Site Scripting
Gallery Images Ape
≤1.6.14Update to 2.0.0
- Critical9.8Arbitrary File Upload
Baggage Freight Shipping Australia
≤0.1.0No patch available
- Medium6.1Cross-Site Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
<3.3.0Update to 3.3.0
- Critical9.8Arbitrary File Upload
Audio Record
≤1.0No patch available
- Medium6.1Cross-Site Scripting
JSmol2WP
≤1.07No patch available
- Critical9.8SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.21.1Update to 3.3.21.2
- High8.8SQL injection
Booking Calendar
≤8.4.3Update to 8.4.4
- High7.5Server-Side Request Forgery
JSmol2WP
≤1.07No patch available
- Medium5.5Authenticated Cross-Site Scripting
XML Sitemap Generator for Google
≤4.0.9Update to 4.1.0
- High8.8Cross-Site Request Forgery
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
<1.4.2Update to 1.4.2
- High8.8Cross-Site Request Forgery
Two Factor Authentication
<1.3.13Update to 1.3.13
- Critical9.1Remote Code Execution
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium5.5Cross-Site Scripting
Read and Understood
<2.2Update to 2.2
- High8.8PHP Object Injection
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.4Stored Cross-Site Scripting via File Uploads
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.7Arbitrary File Deletion
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.4Authenticated Stored Cross-Site Scripting via Comments
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium4.3Authorization Bypass
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.5Sensitive Information Disclosure
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1WordPress Core < 5.0.1 Reflected Cross-Site Scripting
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1Import Cross-Site Scripting
Import and export users and customers
<1.12.1Update to 1.12.1
- High7.5Arbitrary File Read
WebP Express
<0.14.11Update to 0.14.11
- Medium5.4Author+ Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.7.8Update to 5.7.8
- High8.8Authenticated SQL Injection via Settings Import
LoginPress | wp-login Custom Login Page Customizer
<1.1.16Update to 1.1.16
- Critical9.8Local File Inclusion
WP Payeezy Pay
<2.98Update to 2.98