Database
WordPress Vulnerability Database (page 1335)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium4.8 | Cross-Site Scripting via post_title | CVE-2019-20181 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2020-7107 | — | |
| High8.8 | Cross-Site Request Forgery | — | — | |
| High8.8 | 4.0.9, Divi Extra 2.23 - 4.0.9, Divi Builder 2.23 - 4.0.9 - PHP Code Injection | — | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2020-5244 | — | |
| High8.8 | Cross-Site Request Forgery and Cross-Site Scripting | — | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2019-20204 | — | |
| Medium5.3 | Post Submission Spoofing & Stored Cross-Site Scripting | CVE-2019-20203 | — | |
| High7.7 | Sensitive Data Exposure | — | — | |
| High7.6 | Authenticated Plugin Deactivation | CVE-2019-25149 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-20210 | — | |
| Medium6.5 | Authenticated Post Deleition via IDOR | CVE-2019-20209 | — | |
| Medium5.4 | Missing Authorization | CVE-2019-25143 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2019-20211 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2019-20212 | — | |
| Medium5.4 | Cross-Site Request Forgery | — | — | |
| High8.8 | Cross-Site Request Forgery | — | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | — | — | |
| High7.3 | Missing Authorization on REST API routes | — | — | |
| Medium5.4 | Denial of Service | — | — | |
| Medium6.5 | Easy Redirect Manager <= 2.40 - Missing Authorization | CVE-2019-19915 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | — | — | |
| High8.8 | Cross-Site Request Forgery and Cross-Site Scripting | — | — | |
| High7.1 | Missing Authorization | CVE-2020-6168 | — | |
| Critical9.8 | Remote Code Execution via tax_query, meta_query, date_query Parameters | CVE-2020-11928 | — | |
| High7.5 | Local File Inclusion | CVE-2020-11732 | — | |
| Medium6.1 | Authenticated Cross-Site Scripting | CVE-2020-11731 | — | |
| Medium5.8 | Stored Cross-Site Scripting via Block Editor WordPress≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1 | CVE-2019-16780 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1 | CVE-2019-20042 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1 | CVE-2019-20041 | — |
- Medium4.8Cross-Site Scripting via post_title
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.0.13Update to 6.0.14
- Medium6.1Reflected Cross-Site Scripting
Ultimate FAQ Accordion Plugin
≤1.8.29Update to 1.8.30
- High8.8Cross-Site Request Forgery
WP Simple Spreadsheet Fetcher for Google
<0.3.7Update to 0.3.7
- High8.84.0.9, Divi Extra 2.23 - 4.0.9, Divi Builder 2.23 - 4.0.9 - PHP Code Injection
Divi Builder
2.23 – 4.0.9Update to 4.0.10
- High7.5Sensitive Information Disclosure
BuddyPress
≤5.1.1Update to 5.1.2
- High8.8Cross-Site Request Forgery and Cross-Site Scripting
Conversion Tracking for WooCommerce
<2.0.5Update to 2.0.6
- Medium5.4Cross-Site Scripting
Postie
<1.9.41Update to 1.9.41
- Medium5.3Post Submission Spoofing & Stored Cross-Site Scripting
Postie
<1.9.41Update to 1.9.41
- High7.7Sensitive Data Exposure
Import and export users and customers
1.15 – 1.15Update to 1.15.0.1
- High7.6Authenticated Plugin Deactivation
Gallery Images Ape
<2.0.7Update to 2.0.7
- Medium6.1Cross-Site Scripting
EasyBook – Hotel & Tour Booking WordPress Theme
<1.2.2Update to 1.2.2
- Medium6.5Authenticated Post Deleition via IDOR
EasyBook – Hotel & Tour Booking WordPress Theme
<1.2.2Update to 1.2.2
- Medium5.4Missing Authorization
GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law
≤4.0.2Update to 4.0.3
- High7.2Stored Cross-Site Scripting
EasyBook – Hotel & Tour Booking WordPress Theme
≤1.2.1Update to 1.2.2
- High7.2Stored Cross-Site Scripting
EasyBook – Hotel & Tour Booking WordPress Theme
≤1.2.1Update to 1.2.2
- Medium5.4Cross-Site Request Forgery
bbPress Login Register Links On Forum Topic Pages
≤2.7.5Update to 2.8.5
- High8.8Cross-Site Request Forgery
bbPress Members Only
≤1.2.1Update to 1.3.1
- Medium6.4Authenticated Stored Cross-Site Scripting
WP Accessibility
<1.7.0Update to 1.7.0
- High7.3Missing Authorization on REST API routes
Featured Image from URL (FIFU)
≤2.7.7Update to 2.7.8
- Medium5.4Denial of Service
BuddyPress
≤5.1.0Update to 5.1.1
- Medium6.5Easy Redirect Manager <= 2.40 - Missing Authorization
301 Redirects – Redirect Manager
≤2.40Update to 2.45
- Medium6.4Authenticated Stored Cross-Site Scripting
Donorbox – Free Recurring Donation Plugin and Fundraising Platform
<7.1.2Update to 7.1.2
- High8.8Cross-Site Request Forgery and Cross-Site Scripting
Ultimate WordPress Auction
≤4.0.5Update to 4.0.6
- High7.1Missing Authorization
Minimal Coming Soon – Coming Soon Page
<2.15Update to 2.15
- Critical9.8Remote Code Execution via tax_query, meta_query, date_query Parameters
Media Library Assistant
≤2.81Update to 2.82
- High7.5Local File Inclusion
Media Library Assistant
≤2.81Update to 2.82
- Medium6.1Authenticated Cross-Site Scripting
Media Library Assistant
<2.82Update to 2.82
- Medium5.8Stored Cross-Site Scripting via Block Editor
WordPress
≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.3Update to 3.7.32 or 3.8.32 or 3.9.30 or 4.0.29 or 4.1.29 or 4.2.26 or 4.3.22 or 4.4.21 or 4.5.20 or 4.6.17 or 4.7.16 or 4.8.12 or 4.9.13 or 5.0.8 or 5.1.4 or 5.2.5 or 5.3.1