Database

WordPress Vulnerability Database (page 1316)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1316)
Severity	Vulnerability	CVE	Installs	Published
Medium5.4	Stored Cross-Site Scripting Image Gallery with Slideshow Plugin≤1.5.2No patch available	CVE-2017-1002011	—	Apr 1, 2017
Critical9.8	SQL Injection via gid Image Gallery with Slideshow Plugin≤1.5.2No patch available	CVE-2017-1002012	—	Apr 1, 2017
Critical9.8	Blind SQL Injection via imgid Image Gallery with Slideshow Plugin≤1.5.2No patch available	CVE-2017-1002013	—	Apr 1, 2017
Critical9.8	SQL Injection via selectMulGallery Image Gallery with Slideshow Plugin≤1.5.2No patch available	CVE-2017-1002015	—	Apr 1, 2017
High8.2	Open Proxy filedownload≤1.4Update to 2.0	CVE-2015-1000002	—	Mar 27, 2017
Medium6.1	Reflected Cross-Site Scripting YOP Poll<5.8.1Update to 5.8.1	CVE-2017-2127	—	Mar 23, 2017
High8.8	Cross-Site Request Forgery Invite Anyone<1.3.16Update to 1.3.16	CVE-2017-18544	—	Mar 22, 2017
High7.5	Improper Input Validation Invite Anyone≤1.3.15Update to 1.3.16	CVE-2017-18545	—	Mar 22, 2017
High7.5	Email Injection Invite Anyone<1.3.16Update to 1.3.16	CVE-2017-18543	—	Mar 22, 2017
Critical9.8	SQL Injection Search Everything≤8.1.6Update to 8.1.7	CVE-2017-18571	—	Mar 20, 2017
High8.8	SQL Injection Membership Simplified<1.58Update to 1.58	CVE-2017-1002010	—	Mar 17, 2017
Critical9.8	SQL Injection Membership Simplified≤1.58No patch available	CVE-2017-1002009	—	Mar 17, 2017
Medium4.3	Authorization Bypass BuddyPress Docs<1.9.3Update to 1.9.3	CVE-2017-6954	—	Mar 17, 2017
Medium5.3	Change of Email Invitation Content Invite Anyone<1.3.15Update to 1.3.15	CVE-2017-6955	—	Mar 17, 2017
Critical9.8	Arbitrary File Download Membership Simplified≤1.58No patch available	CVE-2017-1002008	—	Mar 13, 2017
High7.5	Missing Authorization DTracker≤1.5No patch available	CVE-2017-1002006	—	Mar 13, 2017
Critical9.8	SQL Injection PICA Photo Gallery≤1.0No patch available	CVE-2017-20247	—	Mar 9, 2017
High7.2	SQL Injection via subscriber_email parameter Mail Masta≤1.0No patch available	CVE-2017-6578	—	Mar 9, 2017
Critical9.8	SQL Injection DTracker≤1.5No patch available	CVE-2017-1002005	—	Mar 8, 2017
High7.5	Authorization Bypass DTracker≤1.5No patch available	CVE-2017-1002007	—	Mar 8, 2017
Critical9.8	SQL Injection DTracker≤1.5No patch available	CVE-2017-1002004	—	Mar 8, 2017
Critical9.8	Arbitrary File Upload Mobile App Builder by WapPress≤1.05No patch available	CVE-2017-1002001	—	Mar 7, 2017
Critical9.8	Arbitrary File Upload Wp2android≤1.1.4No patch available	CVE-2017-1002003	—	Mar 7, 2017
Medium6.1	HTML Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.0.31Update to 3.0.31	CVE-2017-18574	—	Mar 7, 2017
Medium6.4	Authenticated Cross-Site Scripting in Youtube URL Embeds WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6817	—	Mar 6, 2017
Medium6.1	Bypass URL Validation WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6815	—	Mar 6, 2017
Medium6.4	Cross-Site Scripting via Media Metadata WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6814	—	Mar 6, 2017
High8.8	Cross-Site Request Forgery via Press This WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6819	—	Mar 6, 2017
Medium6.4	Cross-Site Scripting via Taxonomy names WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6818	—	Mar 6, 2017
Medium4.9	Arbitrary File Deletion WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3	CVE-2017-6816	—	Mar 6, 2017

Medium5.4
Stored Cross-Site Scripting
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
CVE-2017-1002011Apr 1, 2017
Critical9.8
SQL Injection via gid
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
CVE-2017-1002012Apr 1, 2017
Critical9.8
Blind SQL Injection via imgid
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
CVE-2017-1002013Apr 1, 2017
Critical9.8
SQL Injection via selectMulGallery
Image Gallery with Slideshow Plugin
≤1.5.2No patch available
CVE-2017-1002015Apr 1, 2017
High8.2
Open Proxy
filedownload
≤1.4Update to 2.0
CVE-2015-1000002Mar 27, 2017
Medium6.1
Reflected Cross-Site Scripting
YOP Poll
<5.8.1Update to 5.8.1
CVE-2017-2127Mar 23, 2017
High8.8
Cross-Site Request Forgery
Invite Anyone
<1.3.16Update to 1.3.16
CVE-2017-18544Mar 22, 2017
High7.5
Improper Input Validation
Invite Anyone
≤1.3.15Update to 1.3.16
CVE-2017-18545Mar 22, 2017
High7.5
Email Injection
Invite Anyone
<1.3.16Update to 1.3.16
CVE-2017-18543Mar 22, 2017
Critical9.8
SQL Injection
Search Everything
≤8.1.6Update to 8.1.7
CVE-2017-18571Mar 20, 2017
High8.8
SQL Injection
Membership Simplified
<1.58Update to 1.58
CVE-2017-1002010Mar 17, 2017
Critical9.8
SQL Injection
Membership Simplified
≤1.58No patch available
CVE-2017-1002009Mar 17, 2017
Medium4.3
Authorization Bypass
BuddyPress Docs
<1.9.3Update to 1.9.3
CVE-2017-6954Mar 17, 2017
Medium5.3
Change of Email Invitation Content
Invite Anyone
<1.3.15Update to 1.3.15
CVE-2017-6955Mar 17, 2017
Critical9.8
Arbitrary File Download
Membership Simplified
≤1.58No patch available
CVE-2017-1002008Mar 13, 2017
High7.5
Missing Authorization
DTracker
≤1.5No patch available
CVE-2017-1002006Mar 13, 2017
Critical9.8
SQL Injection
PICA Photo Gallery
≤1.0No patch available
CVE-2017-20247Mar 9, 2017
High7.2
SQL Injection via subscriber_email parameter
Mail Masta
≤1.0No patch available
CVE-2017-6578Mar 9, 2017
Critical9.8
SQL Injection
DTracker
≤1.5No patch available
CVE-2017-1002005Mar 8, 2017
High7.5
Authorization Bypass
DTracker
≤1.5No patch available
CVE-2017-1002007Mar 8, 2017
Critical9.8
SQL Injection
DTracker
≤1.5No patch available
CVE-2017-1002004Mar 8, 2017
Critical9.8
Arbitrary File Upload
Mobile App Builder by WapPress
≤1.05No patch available
CVE-2017-1002001Mar 7, 2017
Critical9.8
Arbitrary File Upload
Wp2android
≤1.1.4No patch available
CVE-2017-1002003Mar 7, 2017
Medium6.1
HTML Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.0.31Update to 3.0.31
CVE-2017-18574Mar 7, 2017
Medium6.4
Authenticated Cross-Site Scripting in Youtube URL Embeds
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6817Mar 6, 2017
Medium6.1
Bypass URL Validation
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6815Mar 6, 2017
Medium6.4
Cross-Site Scripting via Media Metadata
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6814Mar 6, 2017
High8.8
Cross-Site Request Forgery via Press This
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6819Mar 6, 2017
Medium6.4
Cross-Site Scripting via Taxonomy names
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6818Mar 6, 2017
Medium4.9
Arbitrary File Deletion
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
CVE-2017-6816Mar 6, 2017