Database
WordPress Vulnerability Database (page 1308)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.2 | SQL Injection | CVE-2018-5695 | — | |
| High7.5 | Arbitrary File Upload | CVE-2018-25019 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-5285 | — | |
| Medium6.3 | Unauthenticated SQL Injection | CVE-2018-25106 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-5284 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2018-5214 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-5212 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2018-5213 | — | |
| High8.8 | Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter | CVE-2018-6357 | — | |
| Medium6.1 | Open Redirect | CVE-2017-1000434 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2018-3810 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2018-3811 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17869 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2017-17753 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17719 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2017-16949 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17744 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18015 | — | |
| Medium6.1 | Multiple Versions - Cross-Site Scripting | CVE-2017-17780 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-5316 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18010 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18012 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17451 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-20970 | — | |
| Medium6.1 | Reflected Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17094 | — | |
| Medium5.4 | Authorization Bypass WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17091 | — | |
| Medium6.4 | WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17093 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17092 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-0511 | — | |
| Medium6.1 | Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting | CVE-2017-18555 | — |
- High7.2SQL Injection
WP Job Board
<4.5Update to 4.5
- High7.5Arbitrary File Upload
LearnDash LMS
<2.5.4Update to 2.5.4
- High8.8Cross-Site Request Forgery
ImageInject
≤1.15Update to 1.16
- Medium6.3Unauthenticated SQL Injection
NebulaX Theme
<5.0Update to 5.0
- Medium6.1Cross-Site Scripting
ImageInject
≤1.15Update to 1.16
- Medium5.4Stored Cross-Site Scripting
Add Link to Facebook
≤2.3No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
- Medium5.4Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
- High8.8Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter
Social Media Widget by Acurax
<3.2.6Update to 3.2.6
- Medium6.1Open Redirect
furikake
≤0.1.0Update to 0.1.1
- High7.2Stored Cross-Site Scripting
Smart Google Code Inserter
<3.5Update to 3.5
- Critical9.8Unauthenticated SQL Injection
Smart Google Code Inserter
<3.5Update to 3.5
- Medium6.1Cross-Site Scripting
mgl-instagram-gallery
all versionsNo patch available
- Medium5.4Cross-Site Scripting
CSV Import Export
≤1.1No patch available
- Medium6.1Cross-Site Scripting
WP Concours
≤1.1No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
accesspress-anonymous-post-pro
<3.2.0Update to 3.2.0
- Medium6.1Cross-Site Scripting
Custom Map
≤1.1No patch available
- Medium6.1Cross-Site Scripting
Share This Image
<1.04Update to 1.04
- Medium6.1Multiple Versions - Cross-Site Scripting
Clockwork SMS Notfications
≤2.0.3No patch available
- Medium6.1Cross-Site Scripting
SagePay Server Gateway for WooCommerce
<1.0.9Update to 1.0.9
- Medium6.1Cross-Site Scripting
Smart Marketing SMS and Newsletters Forms
<2.0.0Update to 2.0.0
- Medium6.1Cross-Site Scripting
Z-URL Preview
<2.0.0Update to 2.0.0
- Medium6.1Cross-Site Scripting
WP Mailster
<1.5.5Update to 1.5.5
- Medium6.1Reflected Cross-Site Scripting
PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin
<2.0.3Update to 2.0.3
- Medium6.1Reflected Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium5.4Authorization Bypass
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium6.4WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium6.1Cross-Site Scripting
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
≤5.2.0Update to 5.2.2
- Medium6.1Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting
Booking Calendar – Clockwork SMS
≤1.0.5Update to 1.1.0