Database
WordPress Vulnerability Database (page 1337)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.5 | Unauthenticated Arbitrary File Deletion | CVE-2019-17234 | — | |
| Medium5.3 | Information Disclosure | CVE-2019-17235 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium5.4 | Cross-Site Scripting | — | — | |
| Medium5.4 | Arbitrary Plugin Activation | CVE-2019-25151 | — | |
| Medium6.5 | Denial of Service | CVE-2019-18855 | — | |
| Medium6.5 | Denial of Service | CVE-2019-18854 | — | |
| High8.8 | Cross-Site Request Forgery to Stored Cross-Site Scripting | — | — | |
| Medium6.5 | Authorization Bypass | CVE-2019-18668 | — | |
| Medium4.3 | Authenticated Settings Change | CVE-2019-16251 | — | |
| Medium5.3 | Missing Authorization to Settings Update | CVE-2020-20627 | — | |
| Medium4.4 | Authenticated (Subscriber+) CSV Injection | CVE-2019-17661 | — | |
| High8.8 | Arbitrary File Upload | CVE-2020-7055 | — | |
| High8.8 | HTML Injection | CVE-2019-25150 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | — | — | |
| Medium5.4 | HTML injection | CVE-2019-25144 | — | |
| Medium6.1 | HTML Injection | CVE-2019-25148 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2022-1170 | — | |
| High8.8 | SQL Injection | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| High7.2 | Stored Cross-Site Scripting | — | — | |
| High7.2 | Cross-Site Scripting | — | — | |
| High7.1 | Open Redirect | — | — | |
| Medium6.4 | Stored Cross-Site Scripting Jetpack – AI Agents & MCP, Security, Backup & Analytics<7.9.1Update to 5.1.1 or 5.2.2 or 5.3.1 or 5.4.1 or 5.5.2 or 5.6.2 or 5.7.2 or 5.8.1 or 5.9.1 or 6.0.1 or 6.1.2 or 6.2.2 or 6.3.4 or 6.4.3 or 6.5.1 or 6.6.2 or 6.7.1 or 6.8.2 or 6.9.1 or 7.0.2 or 7.1.2 or 7.2.2 or 7.3.2 or 7.4.2 or 7.5.4 or 7.6.1 or 7.7.3 or 7.8.1 or 7.9.1 | — | — | |
| High7.5 | Authenticated SQL Injection | CVE-2020-20625 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2019-16520 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2019-16523 | — | |
| High7.2 | SQL injection | CVE-2019-6012 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-6011 | — | |
| Medium4.3 | Full Path Disclosure | CVE-2019-19983 | — |
- High7.5Unauthenticated Arbitrary File Deletion
IgniteUp – Coming Soon and Maintenance Mode
<3.4.1Update to 3.4.1
- Medium5.3Information Disclosure
IgniteUp – Coming Soon and Maintenance Mode
≤3.4.0Update to 3.4.1
- Medium6.1Reflected Cross-Site Scripting
MC4WP: Mailchimp for WordPress
≤4.1.6Update to 4.1.7
- Medium5.4Cross-Site Scripting
Safe SVG
≤1.9.5Update to 1.9.6
- Medium5.4Arbitrary Plugin Activation
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
≤1.3.0Update to 1.3.1
- Medium6.5Denial of Service
Safe SVG
≤1.9.4Update to 1.9.5
- Medium6.5Denial of Service
Safe SVG
≤1.9.4Update to 1.9.5
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Tidio – Live Chat & AI Chatbots
<4.2.1Update to 4.2.1
- Medium6.5Authorization Bypass
Currency Switcher for WooCommerce
<2.11.2Update to 2.11.2
- Medium4.3Authenticated Settings Change
YITH WooCommerce Wishlist
≤2.2.13Update to 2.2.14
- Medium5.3Missing Authorization to Settings Update
GiveWP – Donation Plugin and Fundraising Platform
<2.5.10Update to 2.5.10
- Medium4.4Authenticated (Subscriber+) CSV Injection
Admin Columns Pro
≤6.4.9Update to 6.4.10
- High8.8Arbitrary File Upload
Elementor Website Builder – more than just a page builder
<2.7.5Update to 2.7.5
- High8.8HTML Injection
Email Templates Customizer and Designer for WordPress and WooCommerce
≤1.3Update to 1.3.1
- Medium6.4Authenticated Stored Cross-Site Scripting
About Author
<1.4.0Update to 1.4.0
- Medium5.4HTML injection
WP Email Template
<2.2.11Update to 2.2.11
- Medium6.1HTML Injection
Email Template Designer – WP HTML Mail
<2.9.1Update to 2.9.1
- Medium6.1Reflected Cross-Site Scripting
Noo JobMonster
<4.5.2.9Update to 4.5.2.9
- High8.8SQL Injection
Groundhogg — CRM, Newsletters, and Marketing Automation
≤1.3.11.13Update to 2.0.8
- Medium6.1Reflected Cross-Site Scripting
Sliced Invoices – WordPress Invoice Plugin
≤3.8.2Update to 3.8.3
- High7.2Stored Cross-Site Scripting
SyntaxHighlighter Evolved
<3.5.1Update to 3.5.1
- High7.2Cross-Site Scripting
InJob | Multi features for recruitment WordPress Theme
<3.3.8Update to 3.3.8
- High7.1Open Redirect
Bridge - Creative Multipurpose WordPress Theme
<18.2.1Update to 18.2.1
- Medium6.4Stored Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<7.9.1Update to 5.1.1 or 5.2.2 or 5.3.1 or 5.4.1 or 5.5.2 or 5.6.2 or 5.7.2 or 5.8.1 or 5.9.1 or 6.0.1 or 6.1.2 or 6.2.2 or 6.3.4 or 6.4.3 or 6.5.1 or 6.6.2 or 6.7.1 or 6.8.2 or 6.9.1 or 7.0.2 or 7.1.2 or 7.2.2 or 7.3.2 or 7.4.2 or 7.5.4 or 7.6.1 or 7.7.3 or 7.8.1 or 7.9.1
- High7.5Authenticated SQL Injection
Sliced Invoices – WordPress Invoice Plugin
<3.8.4Update to 3.8.4
- Medium6.4Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤3.2.6Update to 3.2.7
- Medium6.4Authenticated Stored Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.5Update to 5.9.6
- High7.2SQL injection
wpDataTables (Premium)
≤2.0.11Update to 2.0.12
- Medium6.1Cross-Site Scripting
wpDataTables (Premium)
≤2.0.11Update to 2.0.12
- Medium4.3Full Path Disclosure
Fast Velocity Minify
≤2.7.6Update to 2.7.7