VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1305)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software
Active filters:Clear all

41,244 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1305)
SeverityVulnerabilityCVEInstallsPublished
High8.6CSV Injection
Contact Form DB2.10.32 – 2.10.32Update to 2.10.36
CVE-2018-9035—
High7.5Directory Traversal
WP Background Takeover≤4.1.4Update to 4.1.5
CVE-2018-9118—
Medium6.1Stored Cross-Site Scripting
Iptanus File Upload<4.3.4Update to 4.3.4
CVE-2018-9844—
Medium4.3Security Misconfiguration with URL Hostnames
WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10101—
Medium6.4Authenticated Stored Cross-Site Scripting via Generator Tag
WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10102—
Medium5.4Open Redirect
WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10100—
Medium4.1Cross-Site Scripting via Shortcodes
Iptanus File Upload<4.3.3Update to 4.3.3
CVE-2018-9172—
Medium5.4Cross-Site Scripting
Relevanssi – A Better Search≤4.0.4Update to 4.0.5
CVE-2018-9034—
Medium6.5Cross-Site Request Forgery to Denial of Service
WP Image Zoom≤1.23Update to 1.24
CVE-2018-1000510—
Medium5.3Sensitive Information Disclosure
WP Activity Log≤3.1.1Update to 3.1.2
CVE-2018-8719—
Medium6.4Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.8.1.2Update to 5.8.1.2
CVE-2018-9020—
Critical9.8Local File Inclusion
Site Editor≤1.1.1No patch available
CVE-2018-7422—
Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More≤1.2.32Update to 1.2.33
CVE-2018-75431M+
Medium5.3Spam Injection
MailPoet Newsletters (Previous)≤2.8.1Update to 2.8.2
CVE-2018-20853—
Critical9.8Object Injection
Newsletters<4.6.8.6Update to 4.6.8.6
CVE-2018-20987—
High8.8PHP Object Injection
bbPress Move Topics≤1.1.4Update to 1.1.6
CVE-2018-21005—
High8.8Cross-Site Request Forgery
bbPress Move Topics<1.1.5Update to 1.1.5
CVE-2018-21006—
Medium6.1Multiple Cross-Site Scripting
Activity Log – Monitor User and Agent Changes≤2.4.0Update to 2.4.1
CVE-2018-8729—
Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets<3.4.6Update to 3.4.6
CVE-2018-0546—
Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets<3.4.7Update to 3.4.7
CVE-2018-0547—
Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets<3.4.7Update to 3.4.7
CVE-2018-20978—
Critical9.8Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard<1.2.0Update to 1.2.0
CVE-2018-8711—
Critical9.8Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard<1.2.0Update to 1.2.0
CVE-2018-8710—
High7.5Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection≤6.9.0Update to 6.9.1
CVE-2018-7433—
Medium6.1Cross-Site Scripting
trust-form≤2.0.0Update to 2.0.1
CVE-2017-18613—
High7.5Sensitive Information Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤2.2.46Update to 2.2.50
CVE-2018-7586300K+
High7.5Information Disclosure
File Manager≤5.0.0Update to 5.0.2
CVE-2018-7204—
High7.5Parameter Tampering
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.2.15Update to 3.2.15
CVE-2018-20980—
Critical9.8SQL Injection
WP Support Plus Responsive Ticket System≤9.0.2Update to 9.0.3
CVE-2018-1000131—
Medium6.1Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.2.14Update to 3.2.14
CVE-2018-7280—
  • High8.6
    CSV Injection

    Contact Form DB

    2.10.32 – 2.10.32Update to 2.10.36

    CVE-2018-9035

  • High7.5
    Directory Traversal

    WP Background Takeover

    ≤4.1.4Update to 4.1.5

    CVE-2018-9118

  • Medium6.1
    Stored Cross-Site Scripting

    Iptanus File Upload

    <4.3.4Update to 4.3.4

    CVE-2018-9844

  • Medium4.3
    Security Misconfiguration with URL Hostnames

    WordPress

    ≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5

    CVE-2018-10101

  • Medium6.4
    Authenticated Stored Cross-Site Scripting via Generator Tag

    WordPress

    ≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5

    CVE-2018-10102

  • Medium5.4
    Open Redirect

    WordPress

    ≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5

    CVE-2018-10100

  • Medium4.1
    Cross-Site Scripting via Shortcodes

    Iptanus File Upload

    <4.3.3Update to 4.3.3

    CVE-2018-9172

  • Medium5.4
    Cross-Site Scripting

    Relevanssi – A Better Search

    ≤4.0.4Update to 4.0.5

    CVE-2018-9034

  • Medium6.5
    Cross-Site Request Forgery to Denial of Service

    WP Image Zoom

    ≤1.23Update to 1.24

    CVE-2018-1000510

  • Medium5.3
    Sensitive Information Disclosure

    WP Activity Log

    ≤3.1.1Update to 3.1.2

    CVE-2018-8719

  • Medium6.4
    Cross-Site Scripting

    Events Manager – Calendar, Bookings, Tickets, Appointments and more!

    <5.8.1.2Update to 5.8.1.2

    CVE-2018-9020

  • Critical9.8
    Local File Inclusion

    Site Editor

    ≤1.1.1No patch available

    CVE-2018-7422

  • Medium6.1
    Cross-Site Scripting

    Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

    ≤1.2.32Update to 1.2.33

    CVE-2018-75431M+

  • Medium5.3
    Spam Injection

    MailPoet Newsletters (Previous)

    ≤2.8.1Update to 2.8.2

    CVE-2018-20853

  • Critical9.8
    Object Injection

    Newsletters

    <4.6.8.6Update to 4.6.8.6

    CVE-2018-20987

  • High8.8
    PHP Object Injection

    bbPress Move Topics

    ≤1.1.4Update to 1.1.6

    CVE-2018-21005

  • High8.8
    Cross-Site Request Forgery

    bbPress Move Topics

    <1.1.5Update to 1.1.5

    CVE-2018-21006

  • Medium6.1
    Multiple Cross-Site Scripting

    Activity Log – Monitor User and Agent Changes

    ≤2.4.0Update to 2.4.1

    CVE-2018-8729

  • Medium6.1
    Cross-Site Scripting

    WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

    <3.4.6Update to 3.4.6

    CVE-2018-0546

  • Medium6.1
    Cross-Site Scripting

    WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

    <3.4.7Update to 3.4.7

    CVE-2018-0547

  • Medium6.1
    Cross-Site Scripting

    WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

    <3.4.7Update to 3.4.7

    CVE-2018-20978

  • Critical9.8
    Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion

    HUSKY – Products Filter for WooCommerce Professional. MCP is onboard

    <1.2.0Update to 1.2.0

    CVE-2018-8711

  • Critical9.8
    Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution

    HUSKY – Products Filter for WooCommerce Professional. MCP is onboard

    <1.2.0Update to 1.2.0

    CVE-2018-8710

  • High7.5
    Cross-Site Scripting

    Kadence Security – Password, Two Factor Authentication, and Brute Force Protection

    ≤6.9.0Update to 6.9.1

    CVE-2018-7433

  • Medium6.1
    Cross-Site Scripting

    trust-form

    ≤2.0.0Update to 2.0.1

    CVE-2017-18613

  • High7.5
    Sensitive Information Disclosure

    Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

    ≤2.2.46Update to 2.2.50

    CVE-2018-7586300K+

  • High7.5
    Information Disclosure

    File Manager

    ≤5.0.0Update to 5.0.2

    CVE-2018-7204

  • High7.5
    Parameter Tampering

    Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

    <3.2.15Update to 3.2.15

    CVE-2018-20980

  • Critical9.8
    SQL Injection

    WP Support Plus Responsive Ticket System

    ≤9.0.2Update to 9.0.3

    CVE-2018-1000131

  • Medium6.1
    Cross-Site Scripting

    Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

    <3.2.14Update to 3.2.14

    CVE-2018-7280

Search VulnCrest Radar

Jump to

Are you sure?