Database
WordPress Vulnerability Database (page 1328)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.5 | Arbitrary File Deletion | CVE-2020-12832 | — | |
| Critical9.8 | SQL Injection via bwg_search_x Parameter | CVE-2021-24139 | — | |
| High7.4 | Missing Authorization | CVE-2020-36715 | — | |
| High7.2 | Unauthenticated Stored Cross Site Scripting | — | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2020-14959 | — | |
| Medium6.5 | Failure to Restrict URL Protocol | CVE-2020-12742 | — | |
| Medium6.4 | Stored Cross-Site Scripting | — | — | |
| High8.8 | Cross-Site Request Forgery to Reflected Cross-Site Scripting | CVE-2020-13643 | — | |
| Medium5.5 | Cross-Site Scripting | CVE-2021-24888 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2020-11530 | — | |
| Medium6.1 | Authenticated Stored Cross Site Scripting | CVE-2020-12696 | — | |
| High7.2 | Registration Bypass | CVE-2020-13125 | — | |
| Critical9.9 | Authenticated (Subscriber+) Arbitrary File Upload | CVE-2020-13126 | — | |
| High8.8 | Cross-Site Request Forgery to Reflected Cross-Site Scripting | CVE-2020-13642 | — | |
| High8.8 | Unauthorized Post Meta Creation/Modification | — | — | |
| Medium4.8 | Cross-Site Scripting via s parameter | CVE-2019-19110 | — | |
| Medium6.1 | Cross-Site Scripting via wpf-dw-td-value class | CVE-2019-19112 | — | |
| High8.3 | Authenticated Cross-Site Scripting | — | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-19109 | — | |
| Medium6.1 | Cross-Site Scripting via langid parameter | CVE-2019-19111 | — | |
| Medium5.5 | Stored Cross-Site Scripting | CVE-2020-8799 | — | |
| Medium6.4 | Authenticated (Author+) Cross-Site Scripting via File Uploads WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11026 | — | |
| Medium6.4 | Cross-Site Scripting in the Block Editor WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11030 | — | |
| Medium5.8 | Reflected Cross Site Scripting WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11029 | — | |
| Medium6.1 | Password Reset Link Non-Expiration WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11027 | — | |
| Medium5.8 | Authenticated Cross-Site Scripting via Customizer WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11025 | — | |
| Medium5.8 | Private Post Disclosure WordPress≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1 | CVE-2020-11028 | — | |
| Medium6.1 | Cross-Site Request Forgery leading to Stored Cross-Site Scripting Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.4.24.2Update to 3.4.24.2 | CVE-2020-12462 | — | |
| High8.8 | SQL Injection | CVE-2020-12104 | — | |
| Medium4.3 | Redirect Security Bypass | CVE-2020-36699 | — |
- Medium6.5Arbitrary File Deletion
Simple File List
≤4.2.7Update to 4.2.8
- Critical9.8SQL Injection via bwg_search_x Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.55Update to 1.5.55
- High7.4Missing Authorization
Login & Register Customizer – Forms, Popup, Profile & WooCommerce
<1.5Update to 1.5
- High7.2Unauthenticated Stored Cross Site Scripting
WP Product Review Lite
<3.7.6Update to 3.7.6
- Medium5.4Authenticated Stored Cross-Site Scripting
Easy Testimonials
≤3.5.2Update to 3.6
- Medium6.5Failure to Restrict URL Protocol
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
≤2.3.4Update to 2.3.5
- Medium6.4Stored Cross-Site Scripting
Paytium: Mollie payment forms & donations
≤3.1.1Update to 3.1.2
- High8.8Cross-Site Request Forgery to Reflected Cross-Site Scripting
Page Builder by SiteOrigin
<2.10.16Update to 2.10.16
- Medium5.5Cross-Site Scripting
ImageBoss – Image Optimization & CDN
<3.0.6Update to 3.0.6
- Critical9.8Unauthenticated SQL Injection
Chop Slider 3
≤3.4No patch available
- Medium6.1Authenticated Stored Cross Site Scripting
iframe
≤4.4Update to 4.5
- High7.2Registration Bypass
Ultimate Addons for Elementor
<1.24.2Update to 1.24.2
- Critical9.9Authenticated (Subscriber+) Arbitrary File Upload
Elementor Website Builder Pro
<2.9.4Update to 2.9.4
- High8.8Cross-Site Request Forgery to Reflected Cross-Site Scripting
Page Builder by SiteOrigin
≤2.10.15Update to 2.10.16
- High8.8Unauthorized Post Meta Creation/Modification
WooCommerce
<4.1.0Update to 4.1.0
- Medium4.8Cross-Site Scripting via s parameter
wpForo Forum
≤1.6.5Update to 1.7.0
- Medium6.1Cross-Site Scripting via wpf-dw-td-value class
wpForo Forum
≤1.6.5Update to 1.7.0
- High8.3Authenticated Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
<1.9.25Update to 1.9.25
- High8.8Cross-Site Request Forgery
wpForo Forum
≤1.6.5Update to 1.7.0
- Medium6.1Cross-Site Scripting via langid parameter
wpForo Forum
≤1.6.5Update to 1.7.0
- Medium5.5Stored Cross-Site Scripting
WTI Like Post
<1.4.6Update to 1.4.6
- Medium6.4Authenticated (Author+) Cross-Site Scripting via File Uploads
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium6.4Cross-Site Scripting in the Block Editor
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium5.8Reflected Cross Site Scripting
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium6.1Password Reset Link Non-Expiration
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium5.8Authenticated Cross-Site Scripting via Customizer
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium5.8Private Post Disclosure
WordPress
≤5.4Update to 3.7.33 or 3.8.33 or 3.9.31 or 4.0.30 or 4.1.30 or 4.2.27 or 4.3.23 or 4.4.22 or 4.5.21 or 4.6.18 or 4.7.17 or 4.8.13 or 4.9.14 or 5.0.9 or 5.1.5 or 5.2.6 or 5.3.3 or 5.4.1
- Medium6.1Cross-Site Request Forgery leading to Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.24.2Update to 3.4.24.2
- High8.8SQL Injection
WordPress WP-Advanced-Search
≤3.3.6Update to 3.3.7
- Medium4.3Redirect Security Bypass
Quick Page/Post Redirect Plugin
≤5.1.9Update to 5.2.0