Database
WordPress Vulnerability Database (page 1314)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | User Enumeration | CVE-2017-1000226 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2169 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9063 | — | |
| Medium6.3 | Mishandling Post Meta Values via XML-RPC WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9062 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18578 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18547 | — | |
| High7.5 | Directory Traversal | CVE-2017-1000170 | — | |
| Medium5.9 | Unauthorized Password Reset via Interception | CVE-2017-8295 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18559 | — | |
| Critical9.8 | PHP Object Injection | CVE-2017-18604 | — | |
| Critical9.8 | Object Injection | CVE-2017-18605 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10706 | — | |
| Critical9.8 | Arbitrary file upload | CVE-2017-1002016 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2017-18606 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18607 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2017-18570 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-20008 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-18592 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18608 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18498 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18500 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18516 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18590 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18562 | — | |
| Medium6.1 | Reflected Cross-Site Scripting PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website<1.1.1Update to 1.1.1 | CVE-2017-18529 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18530 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18532 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18533 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18496 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-7723 | — |
- Medium5.3User Enumeration
Stop User Enumeration
<1.3.9Update to 1.3.9
- Medium6.1Cross-Site Scripting
MaxButtons – Create buttons
≤6.18Update to 6.19
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.3Mishandling Post Meta Values via XML-RPC
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.1Cross-Site Scripting
Crafty Social Buttons
<1.5.8Update to 1.5.8
- High8.8Cross-Site Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
<4.6.4Update to 4.6.4
- High7.5Directory Traversal
Task Scheduler
≤1.6.0Update to 1.6.1
- Medium5.9Unauthorized Password Reset via Interception
WordPress
<5.5Update to 5.5
- Medium6.1Cross-Site Scripting
cformsII
≤14.13.2Update to 14.13.3
- Critical9.8PHP Object Injection
SiteBuilder Dynamic Components
≤1.0No patch available
- Critical9.8Object Injection
Gravitate QA Tracker
≤1.2.1No patch available
- Medium6.1Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.3Update to 4.0.3
- Critical9.8Arbitrary file upload
flickr-picture-backup
≤0.7No patch available
- Medium6.1Stored Cross-Site Scripting
Avada | Website Builder For WordPress & WooCommerce
<5.1.5Update to 5.1.5
- High8.8Cross-Site Request Forgery
Avada | Website Builder For WordPress & WooCommerce
<5.1.5Update to 5.1.5
- High7.2Authenticated SQL Injection
cformsII
<14.13Update to 14.13
- Medium6.1Reflected Cross-Site Scripting
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<1.7.8Update to 1.7.8
- Critical9.8Arbitrary File Upload
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
≤3.0.5Update to 3.1.0
- Medium6.1Cross-Site Scripting
Spot.IM Comments
<4.0.4Update to 4.0.4
- Medium6.1Reflected Cross-Site Scripting
Simple Job Board
<2.4.4Update to 2.4.4
- Medium6.1Reflected Cross-Site Scripting
Social Buttons Pack by BestWebSoft
<1.1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
BestWebSoft's LinkedIn
<1.0.5Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting
Timesheet by BestWebSoft
<0.1.5Update to 0.1.5
- Medium6.1Reflected Cross-Site Scripting
Error Log Viewer by BestWebSoft
<1.0.6Update to 1.0.6
- Medium6.1Reflected Cross-Site Scripting
PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website
<1.1.1Update to 1.1.1
- Medium6.1Reflected Cross-Site Scripting
Rating by BestWebSoft
<0.2Update to 0.2
- Medium6.1Reflected Cross-Site Scripting
Realty by BestWebSoft
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Rimons Twitter Widget
≤1.2.4Update to 1.3
- Medium6.1Reflected Cross-Site Scripting
Htaccess by BestWebSoft – WordPress Website Access Control Plugin
<1.7.6Update to 1.7.6
- Medium6.1Cross-Site Scripting
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
<1.2.5Update to 1.2.5