Database
WordPress Vulnerability Database (page 1312)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | SQL Injection | CVE-2017-1002027 | — | |
| Medium6.1 | Event and Gym Fitness WordPress Theme <= 1.6.4 - Reflected Cross-Site Scripting | CVE-2018-11568 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18507 | — | |
| Critical9.8 | SQL Injection | CVE-2017-12199 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-12200 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2017-12068 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2017-1000227 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-12131 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2017-18600 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18540 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2017-1000224 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18539 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2285 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-2284 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002028 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2017-18601 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18538 | — | |
| Medium6.1 | Open Redirect | CVE-2017-2217 | — | |
| High8.8 | SQL Injection | CVE-2017-18602 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18508 | — | |
| Medium6.1 | Authenticated Cross-Site Scripting | CVE-2017-10991 | — | |
| High7.2 | SQL Injection | CVE-2017-1002025 | — | |
| Critical9.8 | SQL Injection via id Parameter | CVE-2017-13137 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-1002026 | — | |
| Medium4.3 | XML External Entity Injection | CVE-2017-10889 | — | |
| Critical9.8 | SQL Injection | CVE-2017-9834 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-18515 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18603 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18511 | — | |
| Medium5.0 | Directory Traversal | CVE-2017-2245 | — |
- High8.8SQL Injection
RK Responsive Contact Form
≤1.0.0No patch available
- Medium6.1Event and Gym Fitness WordPress Theme <= 1.6.4 - Reflected Cross-Site Scripting
Gameplan - Event and Gym Fitness WordPress Theme
≤1.6.4No patch available
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.1.04Update to 7.1.05
- Critical9.8SQL Injection
Ultimate Product Catalog
≤4.2.22Update to 4.2.23
- Medium6.1Cross-Site Scripting
Ultimate Product Catalog
≤4.2.11Update to 4.2.12
- Medium6.1Unauthenticated Cross-Site Scripting
Event List
≤0.7.9Update to 0.7.10
- Medium6.4Authenticated Stored Cross-Site Scripting
Salutation
<3.0.16Update to 3.0.16
- Medium6.1Cross-Site Scripting
Easy Testimonials
≤3.0.4No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting
FormCraft
<3.4Update to 3.4
- Medium6.1Cross-Site Scripting
WebLibrarian
<3.4.8.7Update to 3.4.8.7
- Medium6.5Cross-Site Request Forgery
Embed Plus for YouTube Gallery, Livestream and Lazy Loading with Facades
≤11.8.1Update to 11.8.2
- Medium6.1Cross-Site Scripting
WebLibrarian
<3.4.8.6Update to 3.4.8.6
- Medium6.1Cross-Site Scripting
Simple Custom CSS and JS
≤3.3Update to 3.4
- Medium6.1Reflected Cross-Site Scripting
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
<1.6.5Update to 1.6.5
- Critical9.8SQL Injection
wordpress-gallery-transformation
≤0.7No patch available
- Medium5.4Cross-Site Scripting
IBPS Online Exam Plugin for WordPress
≤1.0No patch available
- Medium6.1Cross-Site Scripting
WebLibrarian
<3.4.8.5Update to 3.4.8.5
- Medium6.1Open Redirect
Download Manager
<2.9.51Update to 2.9.51
- High8.8SQL Injection
IBPS Online Exam Plugin for WordPress
≤1.0No patch available
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.1.02Update to 7.1.03
- Medium6.1Authenticated Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.0.9Update to 12.0.10
- High7.2SQL Injection
Add Edit Delete Listing Module
≤1.0No patch available
- Critical9.8SQL Injection via id Parameter
FormCraft – Form Builder
1.0.5 – 1.0.5Update to 1.0.6
- High8.8Authenticated SQL Injection
Event Expresso Free
≤3.1.37.11.LUpdate to 3.1.37.12.L
- Medium4.3XML External Entity Injection
TablePress – Tables in WordPress made easy
≤1.8Update to 1.8.1
- Critical9.8SQL Injection
WatuPRO
<5.5.3.7Update to 5.5.3.7
- High8.8Authenticated SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.0.7Update to 12.0.8
- Medium6.1Reflected Cross-Site Scripting
Postman SMTP
≤1.7.2No patch available
- High8.8Cross-Site Request Forgery
Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager
≤3.0.8Update to 3.0.8.1
- Medium5.0Directory Traversal
Shortcodes Ultimate – Content Elements
<4.10.0Update to 4.10.0