Database
WordPress Vulnerability Database (page 1303)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2018-13832 | — | |
| Critical9.1 | Insufficient Restrictions during Export Personal Data requests | CVE-2018-20981 | — | |
| High8.8 | Authenticated Arbitrary File Deletion WordPress≤4.9.6Update to 3.7.27 or 3.8.27 or 3.9.25 or 4.0.24 or 4.1.24 or 4.2.21 or 4.3.17 or 4.4.16 or 4.5.15 or 4.6.12 or 4.7.11 or 4.8.7 or 4.9.7 | CVE-2018-12895 | — | |
| Medium6.1 | Authenticated Cross-Site Scripting | CVE-2018-13136 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11105 | — | |
| Medium6.1 | 6.6.4 - Cross-Site Scripting | CVE-2018-0642 | — | |
| High7.2 | Authenticated SQL Injection Kadence Security – Password, Two Factor Authentication, and Brute Force Protection<7.0.3Update to 7.0.3 | CVE-2018-12636 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-21002 | — | |
| Medium6.1 | CSV Injection | CVE-2018-11526 | — | |
| High7.8 | CSV Injection | CVE-2018-11525 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-1000505 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1000512 | — | |
| High8.8 | SQL Injection | CVE-2019-1010104 | — | |
| Critical9.8 | SQL Injection | CVE-2018-10969 | — | |
| High7.3 | Missing Authorization | CVE-2018-11580 | — | |
| High7.5 | Unauthenticated Parameter Manipulation | CVE-2018-10363 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-11633 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-11709 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11486 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-11632 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11485 | — | |
| Medium6.5 | Missing Authorization | CVE-2018-11579 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-0602 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20974 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-0603 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20982 | — | |
| Critical9.8 | Blind SQL Injection | CVE-2018-11309 | — | |
| Critical9.8 | SQL Injection | CVE-2018-11515 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2018-11366 | — | |
| High8.8 | Remote Code Execution | CVE-2019-15873 | — |
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
All In One Favicon
≤4.6Update to 4.7
- Critical9.1Insufficient Restrictions during Export Personal Data requests
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.8Update to 3.3.9
- High8.8Authenticated Arbitrary File Deletion
WordPress
≤4.9.6Update to 3.7.27 or 3.8.27 or 3.9.25 or 4.0.24 or 4.1.24 or 4.2.21 or 4.3.17 or 4.4.16 or 4.5.15 or 4.6.12 or 4.7.11 or 4.8.7 or 4.9.7
- Medium6.1Authenticated Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.17Update to 2.0.18
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.07Update to 8.0.08
- Medium6.16.6.4 - Cross-Site Scripting
FV Flowplayer Video Player
6.1.2 – 6.6.4Update to 6.6.5
- High7.2Authenticated SQL Injection
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
<7.0.3Update to 7.0.3
- High8.8Cross-Site Request Forgery
JS Help Desk – AI-Powered Support & Ticketing System
≤2.0.5Update to 2.0.6
- Medium6.1CSV Injection
Comments Import & Export
≤2.0.4Update to 2.0.5
- High7.8CSV Injection
Advanced Order Export For WooCommerce
≤1.5.4Update to 1.5.5
- Medium6.5Cross-Site Request Forgery
Tooltipy (tooltips for WP)
<5.1Update to 5.1
- Medium6.1Reflected Cross-Site Scripting
Tooltipy (tooltips for WP)
<5.1Update to 5.1
- High8.8SQL Injection
Quick Chat
≤4.14No patch available
- Critical9.8SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
≤3.0.9Update to 3.0.10
- High7.3Missing Authorization
Mass Pages/Posts Creator
≤1.2.2Update to 1.2.3
- High7.5Unauthenticated Parameter Manipulation
Booking calendar, Appointment Booking System
≤2.2.2Update to 2.2.3
- Medium6.5Cross-Site Request Forgery
Digital Goods for WooCommerce Checkout
<2.2Update to 2.2
- Medium6.1Reflected Cross-Site Scripting
wpForo Forum
<1.4.12Update to 1.4.12
- Medium6.1Cross-Site Scripting
Advance Search for WooCommerce
<1.1Update to 1.1
- Medium6.5Cross-Site Request Forgery
Add Social Share Buttons for Whatsapp and Viber
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
Advance Search for WooCommerce
<1.1Update to 1.1
- Medium6.5Missing Authorization
Banner Management For WooCommerce
≤1.1.0Update to 1.1.1
- Medium6.1Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤3.4.12Update to 3.5.0
- High8.8Cross-Site Request Forgery
JS Job Manager
≤1.0.6Update to 1.0.7
- Medium6.1Cross-Site Scripting
Site Reviews
<2.15.3Update to 2.15.3
- Medium6.1Cross-Site Scripting
Media Library Assistant
<2.7.4Update to 2.74
- Critical9.8Blind SQL Injection
membermouse
≤2.2.8Update to 2.2.9
- Critical9.8SQL Injection
wpForo Forum
≤1.4.12Update to 1.4.13
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Loginizer
1.3.8 – 1.3.9Update to 1.4.0
- High8.8Remote Code Execution
ProfileGrid – User Profiles, Groups and Communities
<2.8.6Update to 2.8.6