Database
WordPress Vulnerability Database (page 1313)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.5 | Local File Inclusion | CVE-2017-11658 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18554 | — | |
| Medium6.4 | Authenticated Cross-Site Scripting | CVE-2017-2224 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18032 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2222 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-2216 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18563 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-9419 | — | |
| High8.8 | SQL Injection | CVE-2017-9603 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2017-1002017 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-2195 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2017-9429 | — | |
| High8.8 | SQL Injection | CVE-2017-9418 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-9420 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002018 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002019 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-15863 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18512 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002023 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002021 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-1002022 | — | |
| Critical9.8 | Authenticated SQL Injection | CVE-2017-1002020 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18522 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18523 | — | |
| Medium6.4 | Stored Cross-Site Scripting via filenames WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9061 | — | |
| High8.8 | Cross-Site Request Forgery Filesystem Credential Update WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9064 | — | |
| Medium5.4 | Authorization Bypass Allowing Post Meta Updates WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9065 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2168 | — | |
| High7.7 | Server-Side Request Forgery WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9066 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2187 | — |
- High7.5Local File Inclusion
WP Rocket
<2.10.4Update to 2.10.4
- Medium6.1Cross-Site Scripting
Analytics Tracker
≤1.1.0Update to 1.1.1
- Medium6.4Authenticated Cross-Site Scripting
Event Calendar WD version
<1.0.94Update to 1.0.94
- Medium6.1Cross-Site Scripting
Download Manager
≤2.9.51Update to 2.9.52
- Medium6.1Cross-Site Scripting
WP-Members Membership Plugin
<3.1.8Update to 3.1.8
- Medium6.1Reflected Cross-Site Scripting
Download Manager
<2.9.50Update to 2.9.50
- Medium6.1Cross-Site Scripting
RSVP and Event Management
<2.3.8Update to 2.3.8
- Medium6.1Cross-Site Scripting
WP Custom Fields Search
<1.0Update to 1.0
- High8.8SQL Injection
WP Jobs
<1.5Update to 1.5
- High7.2Stored Cross-Site Scripting
Gift Certificate Creator
≤1.0Update to 1.1
- High8.8Authenticated SQL Injection
Multi Feed Reader
≤2.2.3Update to 2.2.4
- High7.2Authenticated (Admin+) SQL Injection
Event List
<0.7.9Update to 0.7.9
- High8.8SQL Injection
WP-Testimonials
≤3.4.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Spiffy Calendar
<3.3.0Update to 3.3.0
- Critical9.8SQL Injection
Eventr
≤1.02.2No patch available
- Critical9.8SQL Injection
Eventr
≤1.02.2No patch available
- Medium6.1Reflected Cross-Site Scripting
wp-noexternallinks
<3.5.19Update to 3.5.19
- High8.8Cross-Site Request Forgery
Newsletter by Supsystic
<1.1.8Update to 1.1.8
- Critical9.8SQL Injection
Easy Team Manager
≤1.3.2No patch available
- Critical9.8SQL Injection
surveys
≤1.01.8No patch available
- High8.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- Critical9.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- Medium6.1Cross-Site Scripting
EELV Newsletter
<4.6.1Update to 4.6.1
- High8.8Cross-Site Request Forgery
EELV Newsletter
≤4.6.0Update to 4.6.1
- Medium6.4Stored Cross-Site Scripting via filenames
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- High8.8Cross-Site Request Forgery Filesystem Credential Update
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium5.4Authorization Bypass Allowing Post Meta Updates
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
WP Booking System – Booking Calendar
<1.4Update to 1.4
- High7.7Server-Side Request Forgery
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.0.06Update to 7.0.07