Database

WordPress Vulnerability Database (page 1318)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1318)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	SQL Injection via list_id parameter Mail Masta≤1.0No patch available	CVE-2017-6095	—	Feb 18, 2017
High7.2	SQL Injection via member_id parameter Mail Masta≤1.0No patch available	CVE-2017-6575	—	Feb 18, 2017
High7.2	SQL Injection via filter_list parameter Mail Masta≤1.0No patch available	CVE-2017-6572	—	Feb 18, 2017
High7.2	SQL Injection via list_id parameter Mail Masta≤1.0No patch available	CVE-2017-6577	—	Feb 18, 2017
Medium6.1	Reflected Cross-Site Scripting Time Sheets<1.5.0Update to 1.5.0	CVE-2017-18581	—	Feb 17, 2017
Medium6.1	Authenticated (Admin+) Stored Cross-Site Scripting Easy Table≤1.6Update to 1.7	CVE-2017-20108	—	Feb 16, 2017
Medium6.4	Cross-Site Scripting Corner Ad<1.0.8Update to 1.0.8	CVE-2017-18579	—	Feb 16, 2017
High8.1	Authenticated Directory Traversal leading to Local File Inclusion Posts in Page<1.3.0Update to 1.3.0	CVE-2017-18585	—	Feb 13, 2017
High7.5	Directory Traversal Javo Spot - Multi Purpose Directory WordPress Theme<3.0.0Update to 3.0.0	CVE-2017-20287	—	Feb 9, 2017
Medium6.1	Reflected Cross-Site Scripting Raygun≤1.8.0Update to 1.8.1	CVE-2017-9288	—	Feb 7, 2017
Medium6.1	Cross-Site Scripting XO Security<1.5.3Update to 1.5.3	CVE-2017-18541	—	Feb 7, 2017
Critical9.8	SQL Injection Note Press<0.1.2Update to 0.1.2	CVE-2017-18548	—	Feb 6, 2017
High7.3	Arbitrary Page Modification WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2	CVE-2017-1001000	—	Jan 26, 2017
Medium4.3	Authorization Bypass to Term Disclosure WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2	CVE-2017-5610	—	Jan 26, 2017
High8.8	Authenticated SQL Injection WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2	CVE-2017-5611	—	Jan 26, 2017
Medium6.1	Cross-Site Scripting WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2	CVE-2017-5612	—	Jan 26, 2017
Critical9.8	Unauthenticated PHP Object Injection InfiniteWP Client<1.6.1.1Update to 1.6.1.1	CVE-2016-15004	—	Jan 25, 2017
High7.2	Unauthenticated Stored Cross-Site Scripting WangGuard<1.8.0Update to 1.8.0	CVE-2017-20177	—	Jan 18, 2017
Medium6.1	Cross-Site Scripting moreAds SE≤1.4.6Update to 1.4.7	CVE-2017-18526	—	Jan 17, 2017
Medium6.1	Cross-Site Scripting Event Notifier≤1.2.0Update to 1.2.1	CVE-2017-18576	—	Jan 16, 2017
Medium6.1	Cross-Site Scripting Stop User Enumeration<1.3.8Update to 1.3.8	CVE-2017-18536	—	Jan 15, 2017
Medium6.1	Reflected Cross-Site Scripting WP Whois Domain≤1.0.0No patch available	CVE-2017-18612	—	Jan 14, 2017
Medium6.1	Cross-Site Scripting Chained Quiz<1.0Update to 1.0	CVE-2016-10892	—	Jan 12, 2017
Medium5.3	Weak Multi-Site Activation Key for User and Site Signup WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1	CVE-2017-5493	—	Jan 11, 2017
Medium4.3	Information Disclosure WordPress≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1	CVE-2017-5487	—	Jan 11, 2017
High8.8	Cross-Site Request Forgery via Widget Editing WordPress≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1	CVE-2017-5492	—	Jan 11, 2017
High8.8	Cross-Site Request Forgery via Uploading Flash File WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1	CVE-2017-5489	—	Jan 11, 2017
Medium5.5	Stored Cross-Site Scripting via theme directory name WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1	CVE-2017-5490	—	Jan 11, 2017
Medium5.5	Cross-Site Scripting via Name and Version Header of Plugin WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1	CVE-2017-5488	—	Jan 11, 2017
High8.3	Authorization Bypass WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1	CVE-2017-5491	—	Jan 11, 2017

Critical9.8
SQL Injection via list_id parameter
Mail Masta
≤1.0No patch available
CVE-2017-6095Feb 18, 2017
High7.2
SQL Injection via member_id parameter
Mail Masta
≤1.0No patch available
CVE-2017-6575Feb 18, 2017
High7.2
SQL Injection via filter_list parameter
Mail Masta
≤1.0No patch available
CVE-2017-6572Feb 18, 2017
High7.2
SQL Injection via list_id parameter
Mail Masta
≤1.0No patch available
CVE-2017-6577Feb 18, 2017
Medium6.1
Reflected Cross-Site Scripting
Time Sheets
<1.5.0Update to 1.5.0
CVE-2017-18581Feb 17, 2017
Medium6.1
Authenticated (Admin+) Stored Cross-Site Scripting
Easy Table
≤1.6Update to 1.7
CVE-2017-20108Feb 16, 2017
Medium6.4
Cross-Site Scripting
Corner Ad
<1.0.8Update to 1.0.8
CVE-2017-18579Feb 16, 2017
High8.1
Authenticated Directory Traversal leading to Local File Inclusion
Posts in Page
<1.3.0Update to 1.3.0
CVE-2017-18585Feb 13, 2017
High7.5
Directory Traversal
Javo Spot - Multi Purpose Directory WordPress Theme
<3.0.0Update to 3.0.0
CVE-2017-20287Feb 9, 2017
Medium6.1
Reflected Cross-Site Scripting
Raygun
≤1.8.0Update to 1.8.1
CVE-2017-9288Feb 7, 2017
Medium6.1
Cross-Site Scripting
XO Security
<1.5.3Update to 1.5.3
CVE-2017-18541Feb 7, 2017
Critical9.8
SQL Injection
Note Press
<0.1.2Update to 0.1.2
CVE-2017-18548Feb 6, 2017
High7.3
Arbitrary Page Modification
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
CVE-2017-1001000Jan 26, 2017
Medium4.3
Authorization Bypass to Term Disclosure
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
CVE-2017-5610Jan 26, 2017
High8.8
Authenticated SQL Injection
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
CVE-2017-5611Jan 26, 2017
Medium6.1
Cross-Site Scripting
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
CVE-2017-5612Jan 26, 2017
Critical9.8
Unauthenticated PHP Object Injection
InfiniteWP Client
<1.6.1.1Update to 1.6.1.1
CVE-2016-15004Jan 25, 2017
High7.2
Unauthenticated Stored Cross-Site Scripting
WangGuard
<1.8.0Update to 1.8.0
CVE-2017-20177Jan 18, 2017
Medium6.1
Cross-Site Scripting
moreAds SE
≤1.4.6Update to 1.4.7
CVE-2017-18526Jan 17, 2017
Medium6.1
Cross-Site Scripting
Event Notifier
≤1.2.0Update to 1.2.1
CVE-2017-18576Jan 16, 2017
Medium6.1
Cross-Site Scripting
Stop User Enumeration
<1.3.8Update to 1.3.8
CVE-2017-18536Jan 15, 2017
Medium6.1
Reflected Cross-Site Scripting
WP Whois Domain
≤1.0.0No patch available
CVE-2017-18612Jan 14, 2017
Medium6.1
Cross-Site Scripting
Chained Quiz
<1.0Update to 1.0
CVE-2016-10892Jan 12, 2017
Medium5.3
Weak Multi-Site Activation Key for User and Site Signup
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
CVE-2017-5493Jan 11, 2017
Medium4.3
Information Disclosure
WordPress
≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
CVE-2017-5487Jan 11, 2017
High8.8
Cross-Site Request Forgery via Widget Editing
WordPress
≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
CVE-2017-5492Jan 11, 2017
High8.8
Cross-Site Request Forgery via Uploading Flash File
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
CVE-2017-5489Jan 11, 2017
Medium5.5
Stored Cross-Site Scripting via theme directory name
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
CVE-2017-5490Jan 11, 2017
Medium5.5
Cross-Site Scripting via Name and Version Header of Plugin
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
CVE-2017-5488Jan 11, 2017
High8.3
Authorization Bypass
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
CVE-2017-5491Jan 11, 2017