Database
WordPress Vulnerability Database (page 1318)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SQL Injection | — | — | |
| High7.3 | Authorization Bypass | — | — | |
| High7.5 | PHP Object Injection | CVE-2020-28339 | — | |
| Medium6.5 | Settings Bypass leading to Account Creation | — | — | |
| Critical9.8 | SQL Injection | — | — | |
| Critical9.8 | PHP Object Injection | CVE-2020-36718 | — | |
| Critical9.8 | Remote Code Execution | CVE-2020-36847 | — | |
| High8.8 | Author+ SQL Injection | CVE-2021-24143 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium5.4 | Arbitrary File Deletion WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28039 | — | |
| Medium4.8 | Misconfiguration That Allows Trigger of New Installation WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28037 | — | |
| Medium4.3 | Spam Embed on Multisite Installations WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28033 | — | |
| High8.8 | Privilege Escalation via XML-RPC WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28035 | — | |
| High8.8 | Deserialization Gadget WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28032 | — | |
| High8.8 | Privilege Escalation via XML-RPC WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28036 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting via Global Variables WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28034 | — | |
| Medium6.4 | Stored Cross-Site Scripting via post slugs WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28038 | — | |
| Critical9.8 | PHP Object Injection Gadget WordPress<5.5.3Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.8 or 5.2.9 or 5.3.6 or 5.4.4 or 5.5.3 | CVE-2021-29476 | — | |
| Medium4.3 | Cross-Site Request Forgery to Theme Image Change WordPress≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2 | CVE-2020-28040 | — | |
| High8.8 | Remote Code Execution | — | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2020-27344 | — | |
| Critical9.8 | Unauthenticated SQL Injection | — | — | |
| High8.8 | SQL Injection | CVE-2020-5651 | — | |
| Critical9.8 | SQL Injection | CVE-2020-27615 | — | |
| High8.8 | Arbitrary File Upload | — | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2020-5650 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-27356 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2020-28707 | — | |
| High8.8 | Arbitrary Options Update | CVE-2020-36725 | — |
- Critical9.8SQL Injection
Abandoned Cart Lite for WooCommerce
≤5.8.2Update to 5.8.3
- High7.3Authorization Bypass
WooCommerce Blocks
<3.7.1Update to 3.7.1
- High7.5PHP Object Injection
Welcart e-Commerce
<1.9.36Update to 1.9.36
- Medium6.5Settings Bypass leading to Account Creation
WooCommerce
<4.6.2Update to 4.6.2
- Critical9.8SQL Injection
WP Activity Log
<4.1.5Update to 4.1.5
- Critical9.8PHP Object Injection
GDPR CCPA Compliance & Cookie Consent Banner
≤2.3Update to 2.4
- Critical9.8Remote Code Execution
Simple File List
<4.2.3Update to 4.2.3
- High8.8Author+ SQL Injection
AccessPress Social Icons
<1.8.1Update to 1.8.1
- Medium6.1Reflected Cross-Site Scripting
SW Ajax WooCommerce Search
≤1.2.6Update to 1.2.8
- Medium5.4Arbitrary File Deletion
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium4.8Misconfiguration That Allows Trigger of New Installation
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium4.3Spam Embed on Multisite Installations
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- High8.8Privilege Escalation via XML-RPC
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- High8.8Deserialization Gadget
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- High8.8Privilege Escalation via XML-RPC
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium6.1Reflected Cross-Site Scripting
GreenMart – Organic & Food WooCommerce WordPress Theme
≤2.5.1Update to 2.5.2
- Medium6.1Reflected Cross-Site Scripting via Global Variables
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Medium6.4Stored Cross-Site Scripting via post slugs
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- Critical9.8PHP Object Injection Gadget
WordPress
<5.5.3Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.8 or 5.2.9 or 5.3.6 or 5.4.4 or 5.5.3
- Medium4.3Cross-Site Request Forgery to Theme Image Change
WordPress
≤5.5.1Update to 3.7.35 or 3.8.35 or 3.9.33 or 4.0.32 or 4.1.32 or 4.2.29 or 4.3.25 or 4.4.24 or 4.5.23 or 4.6.20 or 4.7.19 or 4.8.15 or 4.9.16 or 5.0.11 or 5.1.7 or 5.2.8 or 5.3.5 or 5.4.3 or 5.5.2
- High8.8Remote Code Execution
PDF File Browser
≤1.3No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- Critical9.8Unauthenticated SQL Injection
Advanced Booking Calendar
<1.6.2Update to 1.6.2
- High8.8SQL Injection
Simple Download Monitor
≤3.8.8Update to 3.8.9
- Critical9.8SQL Injection
Loginizer
<1.6.4Update to 1.6.4
- High8.8Arbitrary File Upload
Super Store Finder
≤6.1Update to 6.2
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Simple Download Monitor
≤3.3.8Update to 3.3.9
- Medium5.4Stored Cross-Site Scripting
Debug Meta Data
≤1.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Stockdio Historical Chart
<2.8.1Update to 2.8.1
- High8.8Arbitrary Options Update
TI WooCommerce Wishlist
≤1.21.11Update to 1.21.12