Database

WordPress Vulnerability Database (page 1311)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1311)
Severity	Vulnerability	CVE	Installs	Published
Medium6.4	Cross-Site Scripting via Shortcodes WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14726	—	Sep 19, 2017
Medium4.9	Directory Traversal via Customizer WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14722	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting via Template Name WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14720	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting in oEmbed WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14724	—	Sep 19, 2017
Medium6.4	Cross-Site Scripting via Javascript: and Data: URLs WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2	CVE-2017-14718	—	Sep 19, 2017
High7.5	Arbitrary Settings Change Post Pay Counter<2.731Update to 2.731	CVE-2017-18584	—	Sep 16, 2017
Critical9.8	PHP Object Injection Post Pay Counter<2.731Update to 2.731	CVE-2017-18583	—	Sep 16, 2017
Medium6.1	Reflected Cross-site Scripting Pinfinity≤1.9.2Update to 2.0	CVE-2017-18599	—	Sep 12, 2017
High8.8	Human Resource Management System < 1.1 - SQL Injection WPHRM – Human Resource Management System for Wordpress \| WordPress<1.1Update to 1.1	CVE-2017-14848	—	Sep 9, 2017
Medium6.1	Cross-Site Scripting MC4WP: Mailchimp for WordPress≤4.1.7Update to 4.1.8	CVE-2017-18577	—	Sep 8, 2017
High7.5	Unauthenticated Backup Download BackWPup – WordPress Backup & Restore Plugin<3.4.2Update to 3.4.2	CVE-2017-2551	—	Sep 8, 2017
Medium6.1	Unauthorized Cross-Site Scripting Participants Database≤1.7.5.9Update to 1.7.5.10	CVE-2017-14126	—	Sep 6, 2017
Medium6.1	Cross-Site Scripting SmokeSignal≤1.2.6Update to 1.2.7	CVE-2017-18535	—	Sep 4, 2017
High8.8	Cross-Site Request Forgery Jayj Quicktag<1.3.2Update to 1.3.2	CVE-2017-18546	—	Aug 28, 2017
Medium6.1	Reflected Cross-Site Scripting JetBackup – Backup, Restore & Migrate≤1.1.46Update to 1.1.47	CVE-2017-10837	—	Aug 24, 2017
Medium6.1	Reflected Cross-Site Scripting Share on Diaspora<0.7.2Update to 0.7.2	CVE-2017-18534	—	Aug 23, 2017
Medium4.7	Reflected Cross Site Scripting Product Vendors<2.0.36Update to 2.0.36	CVE-2017-20193	—	Aug 22, 2017
Medium6.1	Cross-Site Scripting Contact Form, Drag and Drop Form Builder Plugin – Live Forms<3.4.0Update to 3.4.0	CVE-2017-18497	—	Aug 21, 2017
High7.2	Authenticated SQL Injection via tag_id Parameter Photo Gallery by 10Web – Mobile-Friendly Image Gallery<1.3.51Update to 1.3.51	CVE-2017-12977	—	Aug 20, 2017
Medium6.1	Cross-Site Scripting WP Job Board≤4.5.1Update to 5.0	CVE-2017-15375	—	Aug 18, 2017
Medium6.1	Cross-Site Scripting Embed Images in Comments<0.6Update to 0.6	CVE-2017-18561	—	Aug 16, 2017
Medium6.1	Cross-Site Scripting JetBackup – Backup, Restore & Migrate<1.1.47Update to 1.1.47	CVE-2017-18488	—	Aug 11, 2017
Medium6.1	Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting Bridge - Creative Multipurpose WordPress Theme<11.2Update to 11.2	CVE-2017-13138	—	Aug 8, 2017
Critical9.8	Blind SQL Injection Loginizer<1.3.6Update to 1.3.6	CVE-2017-12650	—	Aug 8, 2017
Medium5.4	Stored Cross-Site Scripting UpdraftPlus Premium≤1.13.4Update to 1.13.5	CVE-2017-18593	—	Aug 8, 2017
High8.8	Cross-Site Request Forgery Loginizer<1.3.6Update to 1.3.6	CVE-2017-12651	—	Aug 8, 2017
High7.2	Authenticated (Admin+) SQL Injection Easy Modal<2.1.0Update to 2.1.0	CVE-2017-12946	—	Aug 7, 2017
High7.2	SQL Injection Easy Modal<2.1.0Update to 2.1.0	CVE-2017-12947	—	Aug 7, 2017
Medium6.1	Cross-Site Scripting PressForward<5.2.4Update to 5.2.4	CVE-2017-12948	—	Aug 7, 2017
High8.0	Authenticated SQL Injection Podlove Podcast Publisher<2.6.0Update to 2.6.0	CVE-2017-12949	—	Aug 7, 2017

Medium6.4
Cross-Site Scripting via Shortcodes
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14726Sep 19, 2017
Medium4.9
Directory Traversal via Customizer
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14722Sep 19, 2017
Medium6.4
Cross-Site Scripting via Template Name
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14720Sep 19, 2017
Medium6.4
Cross-Site Scripting in oEmbed
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14724Sep 19, 2017
Medium6.4
Cross-Site Scripting via Javascript: and Data: URLs
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
CVE-2017-14718Sep 19, 2017
High7.5
Arbitrary Settings Change
Post Pay Counter
<2.731Update to 2.731
CVE-2017-18584Sep 16, 2017
Critical9.8
PHP Object Injection
Post Pay Counter
<2.731Update to 2.731
CVE-2017-18583Sep 16, 2017
Medium6.1
Reflected Cross-site Scripting
Pinfinity
≤1.9.2Update to 2.0
CVE-2017-18599Sep 12, 2017
High8.8
Human Resource Management System < 1.1 - SQL Injection
WPHRM – Human Resource Management System for Wordpress | WordPress
<1.1Update to 1.1
CVE-2017-14848Sep 9, 2017
Medium6.1
Cross-Site Scripting
MC4WP: Mailchimp for WordPress
≤4.1.7Update to 4.1.8
CVE-2017-18577Sep 8, 2017
High7.5
Unauthenticated Backup Download
BackWPup – WordPress Backup & Restore Plugin
<3.4.2Update to 3.4.2
CVE-2017-2551Sep 8, 2017
Medium6.1
Unauthorized Cross-Site Scripting
Participants Database
≤1.7.5.9Update to 1.7.5.10
CVE-2017-14126Sep 6, 2017
Medium6.1
Cross-Site Scripting
SmokeSignal
≤1.2.6Update to 1.2.7
CVE-2017-18535Sep 4, 2017
High8.8
Cross-Site Request Forgery
Jayj Quicktag
<1.3.2Update to 1.3.2
CVE-2017-18546Aug 28, 2017
Medium6.1
Reflected Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
≤1.1.46Update to 1.1.47
CVE-2017-10837Aug 24, 2017
Medium6.1
Reflected Cross-Site Scripting
Share on Diaspora
<0.7.2Update to 0.7.2
CVE-2017-18534Aug 23, 2017
Medium4.7
Reflected Cross Site Scripting
Product Vendors
<2.0.36Update to 2.0.36
CVE-2017-20193Aug 22, 2017
Medium6.1
Cross-Site Scripting
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.4.0Update to 3.4.0
CVE-2017-18497Aug 21, 2017
High7.2
Authenticated SQL Injection via tag_id Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.3.51Update to 1.3.51
CVE-2017-12977Aug 20, 2017
Medium6.1
Cross-Site Scripting
WP Job Board
≤4.5.1Update to 5.0
CVE-2017-15375Aug 18, 2017
Medium6.1
Cross-Site Scripting
Embed Images in Comments
<0.6Update to 0.6
CVE-2017-18561Aug 16, 2017
Medium6.1
Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
<1.1.47Update to 1.1.47
CVE-2017-18488Aug 11, 2017
Medium6.1
Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting
Bridge - Creative Multipurpose WordPress Theme
<11.2Update to 11.2
CVE-2017-13138Aug 8, 2017
Critical9.8
Blind SQL Injection
Loginizer
<1.3.6Update to 1.3.6
CVE-2017-12650Aug 8, 2017
Medium5.4
Stored Cross-Site Scripting
UpdraftPlus Premium
≤1.13.4Update to 1.13.5
CVE-2017-18593Aug 8, 2017
High8.8
Cross-Site Request Forgery
Loginizer
<1.3.6Update to 1.3.6
CVE-2017-12651Aug 8, 2017
High7.2
Authenticated (Admin+) SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
CVE-2017-12946Aug 7, 2017
High7.2
SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
CVE-2017-12947Aug 7, 2017
Medium6.1
Cross-Site Scripting
PressForward
<5.2.4Update to 5.2.4
CVE-2017-12948Aug 7, 2017
High8.0
Authenticated SQL Injection
Podlove Podcast Publisher
<2.6.0Update to 2.6.0
CVE-2017-12949Aug 7, 2017