Database

WordPress Vulnerability Database (page 1307)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1307)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Weblizar Pin Feeds<1.1.2Update to 1.1.2	CVE-2018-5654	—	Jan 12, 2018
Medium5.5	Stored Cross-Site Scripting Read and Understood≤2.1Update to 2.2	CVE-2018-5667	—	Jan 12, 2018
Medium5.5	Cross-Site Scripting via bg_color parameter Coming Soon Page – Responsive Coming Soon & Maintenance Mode≤1.1.18Update to 1.1.19	CVE-2018-5666	—	Jan 12, 2018
Medium5.5	Cross-Site Scripting via logo_height parameter Coming Soon Page – Responsive Coming Soon & Maintenance Mode≤1.1.18Update to 1.1.19	CVE-2018-5665	—	Jan 12, 2018
Medium5.5	Cross-Site Scripting via coming-soon_sub_title parameter Coming Soon Page – Responsive Coming Soon & Maintenance Mode≤1.1.18Update to 1.1.19	CVE-2018-5660	—	Jan 12, 2018
High8.8	Cross-Site Request Forgery Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5673	—	Jan 12, 2018
High8.8	Cross-Site Request Forgery WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5361	—	Jan 11, 2018
Medium5.5	Cross-Site Scripting Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5670	—	Jan 11, 2018
High8.8	Cross-Site Request Forgery SrbTransLatin – Serbian Latinisation≤1.46Update to 1.47	CVE-2018-5368	—	Jan 11, 2018
Medium5.5	Cross-Site Scripting Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5672	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[more_languages] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5366	—	Jan 11, 2018
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5365	—	Jan 11, 2018
Medium5.5	Cross-Site Scripting Booking calendar, Appointment Booking System<2.1.8Update to 2.1.8	CVE-2018-5671	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[post_type][post] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5367	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting SrbTransLatin – Serbian Latinisation≤1.46Update to 1.47	CVE-2018-5369	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[enabled_languages] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5363	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5364	—	Jan 11, 2018
Medium4.8	Cross-Site Scripting via wpglobus_option[post_type][page] WPGlobus≤1.9.6Update to 1.9.7	CVE-2018-5362	—	Jan 11, 2018
High8.8	SQL Injection Dbox 3D Slider Lite≤1.2.2Update to 1.2.3	CVE-2018-5374	—	Jan 11, 2018
High8.8	Authenticated SQL Injection Smooth Slider<2.8.7Update to 2.8.7	CVE-2018-5373	—	Jan 10, 2018
High8.8	SQL Injection Testimonial Slider<1.2.5Update to 1.2.5	CVE-2018-5372	—	Jan 10, 2018
Critical9.8	SQL Injection WP Events Calendar Plugin≤1.0Update to 1.1	CVE-2018-5315	—	Jan 9, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5287	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5291	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5290	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5292	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5293	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5286	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5288	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5289	—	Jan 8, 2018

Medium6.1
Cross-Site Scripting
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
CVE-2018-5654Jan 12, 2018
Medium5.5
Stored Cross-Site Scripting
Read and Understood
≤2.1Update to 2.2
CVE-2018-5667Jan 12, 2018
Medium5.5
Cross-Site Scripting via bg_color parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
CVE-2018-5666Jan 12, 2018
Medium5.5
Cross-Site Scripting via logo_height parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
CVE-2018-5665Jan 12, 2018
Medium5.5
Cross-Site Scripting via coming-soon_sub_title parameter
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.1.18Update to 1.1.19
CVE-2018-5660Jan 12, 2018
High8.8
Cross-Site Request Forgery
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5673Jan 12, 2018
High8.8
Cross-Site Request Forgery
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5361Jan 11, 2018
Medium5.5
Cross-Site Scripting
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5670Jan 11, 2018
High8.8
Cross-Site Request Forgery
SrbTransLatin – Serbian Latinisation
≤1.46Update to 1.47
CVE-2018-5368Jan 11, 2018
Medium5.5
Cross-Site Scripting
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5672Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[more_languages]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5366Jan 11, 2018
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5365Jan 11, 2018
Medium5.5
Cross-Site Scripting
Booking calendar, Appointment Booking System
<2.1.8Update to 2.1.8
CVE-2018-5671Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[post_type][post]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5367Jan 11, 2018
Medium4.8
Cross-Site Scripting
SrbTransLatin – Serbian Latinisation
≤1.46Update to 1.47
CVE-2018-5369Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[enabled_languages]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5363Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5364Jan 11, 2018
Medium4.8
Cross-Site Scripting via wpglobus_option[post_type][page]
WPGlobus
≤1.9.6Update to 1.9.7
CVE-2018-5362Jan 11, 2018
High8.8
SQL Injection
Dbox 3D Slider Lite
≤1.2.2Update to 1.2.3
CVE-2018-5374Jan 11, 2018
High8.8
Authenticated SQL Injection
Smooth Slider
<2.8.7Update to 2.8.7
CVE-2018-5373Jan 10, 2018
High8.8
SQL Injection
Testimonial Slider
<1.2.5Update to 1.2.5
CVE-2018-5372Jan 10, 2018
Critical9.8
SQL Injection
WP Events Calendar Plugin
≤1.0Update to 1.1
CVE-2018-5315Jan 9, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5287Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5291Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5290Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5292Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5293Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5286Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5288Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5289Jan 8, 2018