Database
WordPress Vulnerability Database (page 1340)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2019-16117 | — | |
| High7.5 | Arbitrary Settings Change | CVE-2019-15895 | — | |
| Medium6.1 | Reflected Cross Site Scripting | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16332 | — | |
| Medium5.4 | Reflected Cross-Site Scripting via Shortcode Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16219 | — | |
| High7.2 | Stored Cross-Site Scripting via Comments WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16218 | — | |
| Medium4.6 | Open Redirect WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16220 | — | |
| Medium6.1 | Reflected Cross-Site Scripting WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16221 | — | |
| Medium6.4 | Stored Cross-Site Scripting via Comments via URLs WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16222 | — | |
| Medium6.4 | Cross-Site Scripting via Media Uploads WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16217 | — | |
| Medium5.4 | Authenticated Cross-Site Scripting via Post Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16223 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Cross-Site Scripting | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| High8.8 | CSV Injection | CVE-2019-16120 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-1010124 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2019-15777 | — | |
| High7.5 | Unauthenticated Settings Change | CVE-2019-15816 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14314 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15769 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9352 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-14470 | — | |
| Medium5.3 | Improper Input Validation | CVE-2019-14978 | — | |
| High7.5 | Missing Authorization to Settings Update | CVE-2019-15821 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15770 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2019-15778 | — | |
| High7.5 | Missing Authorization Checks | CVE-2015-9331 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18564 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-14774 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-15817 | — |
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.35Update to 1.5.35
- High7.5Arbitrary Settings Change
Search Exclude
<1.2.4Update to 1.2.4
- Medium6.1Reflected Cross Site Scripting
Qwizcards | online quizzes and flashcards
<3.37Update to 3.37
- Medium6.1Cross-Site Scripting
API Bearer Auth
<20190907Update to 20190907
- Medium5.4Reflected Cross-Site Scripting via Shortcode Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- High7.2Stored Cross-Site Scripting via Comments
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium4.6Open Redirect
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.1Reflected Cross-Site Scripting
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.4Stored Cross-Site Scripting via Comments via URLs
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.4Cross-Site Scripting via Media Uploads
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium5.4Authenticated Cross-Site Scripting via Post Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.1Reflected Cross-Site Scripting
ECPay Logistics for WooCommerce
≤1.2.181030Update to 1.3.1910240
- Medium6.1Cross-Site Scripting
Spryng Payments for WooCommerce
≤1.6.7No patch available
- Medium6.1Reflected Cross-Site Scripting
Portrait-Archiv Photostore – Sell Photos & Client Galleries
<3.2Update to 3.2
- High8.8CSV Injection
Event Tickets and Registration
≤4.10.7.1Update to 4.10.7.2
- Medium6.1Reflected Cross-Site Scripting
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤3.1.14Update to 3.1.15
- Medium5.4Cross-Site Scripting
WP DSGVO Tools (GDPR)
<2.2.19Update to 2.2.19
- High7.5Unauthenticated Settings Change
WP Private Content Plus
≤1.31Update to 2.0
- Critical9.8SQL Injection
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<3.2.11Update to 3.2.11
- High8.8Cross-Site Request Forgery
HandL UTM Grabber / Tracker
<2.6.5Update to 2.6.5
- Critical9.8SQL Injection
WP-Polls
≤2.71Update to 2.72
- Medium6.1Reflected Cross-Site Scripting
UserPro - Community and User Profile WordPress Plugin
≤4.9.34Update to 4.9.35.1
- Medium5.3Improper Input Validation
WooCommerce PayU India (PayUmoney – PayUbiz)
≤2.1.1No patch available
- High7.5Missing Authorization to Settings Update
Bold Page Builder
≤2.3.1Update to 2.3.2
- High8.8Cross-Site Request Forgery
Address Book for WooCommerce
<1.6.0Update to 1.6.0
- Medium6.4Authenticated Stored Cross-Site Scripting
Additional Variation Images Gallery for WooCommerce
<1.1.29Update to 1.2.29
- High7.5Missing Authorization Checks
WP All Import Pro
<4.1.1Update to 4.1.1
- Medium6.1Reflected Cross-Site Scripting
Sender by BestWebSoft
≤1.2.0Update to 1.2.1
- Medium6.1Reflected Cross-Site Scripting
Variation Swatches for WooCommerce
<1.0.62Update to 1.0.62
- Medium6.1Cross-Site Scripting
Easy Property Listings
≤3.3.3Update to 3.4