Database
WordPress Vulnerability Database (page 1338)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2019-6011 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-19306 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-16521 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting via Customizer WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17674 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-20626 | — | |
| Medium5.3 | Authorization Bypass WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17671 | — | |
| Medium5.4 | Server Side Request Forgery #2 WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17670 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9508 | — | |
| Medium5.4 | Server Side Request Forgery WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17669 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17672 | — | |
| High7.5 | Unauthenticated information disclosure | CVE-2019-17574 | — | |
| Medium5.4 | Reflected Cross-Site Scripting | CVE-2019-17207 | — | |
| Medium5.5 | Type Confusion WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17675 | — | |
| High7.3 | Cache Poisoning WordPress≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4 | CVE-2019-17673 | — | |
| High7.5 | Unauthenticated Arbitrary File Deletion | CVE-2019-16902 | — | |
| High8.0 | Authenticated (Admin+) SQL Injection | CVE-2019-17072 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-17070 | — | |
| Medium5.5 | Authenticated (Admin+) Cross-Site Scripting | CVE-2019-17071 | — | |
| Medium6.4 | Stored Cross-Site Scripting | — | — | |
| Critical9.8 | Authentication Bypass | — | — | |
| High7.2 | Missing Authorization to Stored Cross-Site Scripting | CVE-2019-25214 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2019-17239 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2017-14760 | — | |
| High8.8 | Cross-Site Request Forgery | — | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-16931 | — | |
| Critical9.3 | Server-Side Request Forgery | CVE-2019-16932 | — | |
| High7.5 | Authorization Bypass | CVE-2019-20360 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | — | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2019-16524 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2019-25216 | — |
- Medium6.1Cross-Site Scripting
wpDataTables (Premium)
≤2.0.11Update to 2.0.12
- Medium6.1Reflected Cross-Site Scripting
Zoho CRM Lead Magnet
<1.6.9.2Update to 1.6.9.2
- Medium6.1Reflected Cross-Site Scripting
Broken Link Checker
<1.11.9Update to 1.11.9
- Medium5.5Authenticated Stored Cross-Site Scripting via Customizer
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.4Stored Cross-Site Scripting
Lara's Google Analytics (GA4)
<2.0.5Update to 2.0.5
- Medium5.3Authorization Bypass
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium5.4Server Side Request Forgery #2
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – Commissions
≤3.1.2Update to 3.1.3
- Medium5.4Server Side Request Forgery
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- High7.5Unauthenticated information disclosure
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.8.12Update to 1.8.13
- Medium5.4Reflected Cross-Site Scripting
Broken Link Checker
<1.11.9Update to 1.11.9
- Medium5.5Type Confusion
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.14 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- High7.3Cache Poisoning
WordPress
≤5.2.3Update to 3.7.31 or 3.8.31 or 3.9.29 or 4.0.28 or 4.1.28 or 4.2.25 or 4.3.21 or 4.4.20 or 4.5.19 or 4.6.16 or 4.7.15 or 4.8.11 or 4.9.12 or 5.0.7 or 5.1.3 or 5.2.4
- High7.5Unauthenticated Arbitrary File Deletion
ARforms
≤3.7.1Update to 4.0
- High8.0Authenticated (Admin+) SQL Injection
Contact Form Widget – Responsive Contact Form, Query Form & Form Builder
≤1.3.8Update to 1.3.9
- Medium6.1Cross-Site Scripting
LIQUID SPEECH BALLOON
<1.0.7Update to 1.0.7
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Client Dash
≤2.2.0No patch available
- Medium6.4Stored Cross-Site Scripting
SoundPress Plugin
<3.0.0Update to 3.0.0
- Critical9.8Authentication Bypass
Kadence Central – Site Management, Backups, Security, and Reporting
<2.0.18Update to 2.0.18
- High7.2Missing Authorization to Stored Cross-Site Scripting
ShopWP
≤2.0.4Update to 2.0.5
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Download Plugins and Themes in ZIP from Dashboard
<1.6.0Update to 1.6.0
- Critical9.8Unauthenticated SQL Injection
Event Expresso Free
≤3.1.37.12Update to 3.1.37.14 or 3.1.37.14L
- High8.8Cross-Site Request Forgery
Theme Editor
<2.2Update to 2.2
- Medium6.1Stored Cross-Site Scripting
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.3.0Update to 3.3.1
- Critical9.3Server-Side Request Forgery
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.3.0Update to 3.3.1
- High7.5Authorization Bypass
GiveWP – Donation Plugin and Fundraising Platform
≤2.5.4Update to 2.5.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Yoast Duplicate Post
<3.2.4Update to 3.2.4
- Medium5.5Authenticated Stored Cross-Site Scripting
Firelight Lightbox
≤1.8.17Update to 1.8.18
- High7.2Stored Cross-Site Scripting
Rich Reviews by Starfish
≤1.7.4Update to 1.8.0