Database
WordPress Vulnerability Database (page 1302)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Stored Cross-Site Scripting | CVE-2018-16967 | 1M+ | |
| Critical9.8 | Unauthenticated Arbitrary File Upload/Download | CVE-2018-25105 | 1M+ | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-16966 | 1M+ | |
| High7.5 | PHAR Unserialization WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-1000773 | — | |
| Critical9.8 | Privilege Escalation | CVE-2018-16613 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-16363 | 1M+ | |
| Medium6.3 | Authorization Bypass | CVE-2018-20979 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2018-16285 | — | |
| Critical9.8 | Sensitive Information Disclosure leading to Remote Code Execution Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More≤1.2.40Update to 1.2.42 | CVE-2018-17207 | 1M+ | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-17138 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-17140 | — | |
| High8.8 | Remote Command Injection | CVE-2018-15877 | — | |
| Critical9.8 | SQL Injection | CVE-2018-16159 | — | |
| Medium5.3 | CAPTCHA Reuse | CVE-2018-15876 | — | |
| High7.3 | CSV Injection | CVE-2019-15092 | — | |
| High8.6 | CSV Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.13Update to 3.3.14 | CVE-2018-16308 | — | |
| High8.8 | Insecure Deserialization | CVE-2017-1000600 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2018-14502 | — | |
| High8.6 | CSV Injection | CVE-2018-15571 | — | |
| Medium6.6 | Authenticated(Administrator+) PHP File Upload WordPress≤6.4.2Update to 4.1.40 or 4.2.37 or 4.3.33 or 4.4.32 or 4.5.31 or 4.6.28 or 4.7.28 or 4.8.24 or 4.9.25 or 5.0.21 or 5.1.18 or 5.2.20 or 5.3.17 or 5.4.15 or 5.5.14 or 5.6.13 or 5.7.11 or 5.8.9 or 5.9.9 or 6.0.7 or 6.1.5 or 6.2.4 or 6.3.3 or 6.4.3 | CVE-2018-14028 | — | |
| Medium6.5 | Authenticated (Custom+) Arbitrary File Deletion | CVE-2018-25308 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20966 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-17884 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2018-14846 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2018-17947 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-14430 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2018-13137 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-21001 | — | |
| Medium6.4 | < 1.10.4 - Cross-Site Scripting | CVE-2018-14071 | — | |
| High7.2 | Local File Inclusion | CVE-2018-1000504 | — |
- Medium6.1Stored Cross-Site Scripting
File Manager
≤3.0Update to 3.1
- Critical9.8Unauthenticated Arbitrary File Upload/Download
File Manager
≤3.0Update to 3.1
- High8.8Cross-Site Request Forgery
File Manager
≤3.0Update to 3.1
- High7.5PHAR Unserialization
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Critical9.8Privilege Escalation
wpForo Forum
≤1.5.1Update to 1.5.2
- Medium6.1Reflected Cross-Site Scripting
File Manager
<3.0Update to 3.0
- Medium6.3Authorization Bypass
Contact Form 7
<5.0.4Update to 5.0.4
- Medium6.1Unauthenticated Cross-Site Scripting
UserPro - Community and User Profile WordPress Plugin
≤4.9.23Update to 4.9.24
- Critical9.8Sensitive Information Disclosure leading to Remote Code Execution
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.40Update to 1.2.42
- Medium6.4Authenticated Stored Cross-Site Scripting
Jibu Pro
≤1.7No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Quizlord
≤2.0No patch available
- High8.8Remote Command Injection
Plainview Activity Monitor
<20180826Update to 20180826
- Critical9.8SQL Injection
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
<4.1.8Update to 4.1.8
- Medium5.3CAPTCHA Reuse
Ajax BootModal Login
≤1.4.3No patch available
- High7.3CSV Injection
Export and Import Users and Customers
<1.3.2Update to 1.3.2
- High8.6CSV Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.13Update to 3.3.14
- High8.8Insecure Deserialization
WordPress
<4.9Update to 4.9
- Critical9.8Unauthenticated SQL Injection
Chained Quiz
<1.0.9Update to 1.0.9
- High8.6CSV Injection
Export Users to CSV
≤1.1.1No patch available
- Medium6.6Authenticated(Administrator+) PHP File Upload
WordPress
≤6.4.2Update to 4.1.40 or 4.2.37 or 4.3.33 or 4.4.32 or 4.5.31 or 4.6.28 or 4.7.28 or 4.8.24 or 4.9.25 or 5.0.21 or 5.1.18 or 5.2.20 or 5.3.17 or 5.4.15 or 5.5.14 or 5.6.13 or 5.7.11 or 5.8.9 or 5.9.9 or 6.0.7 or 6.1.5 or 6.2.4 or 6.3.3 or 6.4.3
- Medium6.5Authenticated (Custom+) Arbitrary File Deletion
BuddyPress Xprofile Custom Fields Type
≤2.6.3No patch available
- Medium6.1Cross-Site Scripting
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<3.8.0Update to 3.8.0
- Medium6.1Cross-Site Scripting
Gwolle Guestbook
≤2.5.3Update to 2.5.4
- Medium6.4Stored Cross-Site Scripting
Multi Step Form
<1.2.6Update to 1.2.6
- Medium6.1Multiple Cross-Site Scripting
Snazzy Maps
≤1.1.4Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
Multi Step Form
<1.2.6Update to 1.2.6
- Medium4.8Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.4Update to 5.9.5
- Medium6.1Cross-Site Scripting
AnyComment
≤0.0.32Update to 0.0.33
- Medium6.4< 1.10.4 - Cross-Site Scripting
Geo Mashup
<1.10.4Update to 1.10.4
- High7.2Local File Inclusion
Redirection
≤2.7.3Update to 2.8