Database
WordPress Vulnerability Database (page 1352)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium4.3 | Path Traversal | — | — | |
| Critical9.8 | Missing Authorization to Arbitrary Options Update | CVE-2019-6703 | — | |
| High8.8 | Cross-Site Request Forgery | — | — | |
| Critical9.8 | Local File Inclusion | CVE-2019-15322 | — | |
| Critical9.8 | Social Media API Key Leakage <= 1.7.1 - Information Exposure | CVE-2018-20555 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-6267 | — | |
| High8.8 | Cross-Site Request Forgery and Local File Inclusion | CVE-2019-15113 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-6117 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2018-16206 | — | |
| Medium6.4 | Cross-Site Scripting | — | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2018-25436 | — | |
| Medium6.1 | Cross-Site Request Forgery | CVE-2019-1000003 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2024-51792 | — | |
| Critical9.8 | SQL Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤3.3.21.1Update to 3.3.21.2 | CVE-2019-15025 | — | |
| High7.5 | PHP Object Injection via PHAR Deserialization | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20462 | — | |
| Critical10.0 | Privilege Escalation | — | — | |
| High8.8 | SQL injection | CVE-2018-20556 | — | |
| Medium6.1 | Cross-Site Scripting | — | — | |
| High7.5 | Server-Side Request Forgery | CVE-2018-20463 | — | |
| Medium5.5 | Authenticated Cross-Site Scripting | CVE-2018-16204 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20968 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20231 | — | |
| Critical9.1 | Remote Code Execution | CVE-2018-20156 | — | |
| Medium5.5 | Cross-Site Scripting | CVE-2018-5668 | — | |
| High7.5 | Sensitive Information Disclosure WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20151 | — | |
| Medium4.3 | Authorization Bypass WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20152 | — | |
| High8.8 | PHP Object Injection WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20148 | — | |
| Medium6.1 | WordPress Core < 5.0.1 Reflected Cross-Site Scripting WordPress≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1 | CVE-2018-20150 | — |
- Medium4.3Path Traversal
Health Check & Troubleshooting
≤1.2.3Update to 1.2.4
- Critical9.8Missing Authorization to Arbitrary Options Update
Total Donations
≤2.0.5Update to 3.0.0
- High8.8Cross-Site Request Forgery
Polylang
<2.5.1Update to 2.5.1
- Critical9.8Local File Inclusion
Shortcode Factory
≤2.7Update to 2.8
- Critical9.8Social Media API Key Leakage <= 1.7.1 - Information Exposure
Social Network Tabs
≤1.7.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
Companion Auto Update
<3.3.6Update to 3.3.6
- Medium6.1Cross-Site Scripting
Easy Redirect Manager
≤2.18.18No patch available
- High8.8Cross-Site Request Forgery and Local File Inclusion
Companion Sitemap Generator – Simple, Smart, and SEO-Ready
≤3.6.6Update to 3.7.0
- Medium6.1Stored Cross-Site Scripting
Gallery Images Ape
≤1.6.14Update to 2.0.0
- Medium6.1Unauthenticated Cross-Site Scripting
spam-byebye
≤2.2.1Update to 2.2.2
- Medium6.4Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤1.5.5Update to 1.5.6
- Critical9.8Arbitrary File Upload
Baggage Freight Shipping Australia
≤0.1.0No patch available
- Medium6.1Cross-Site Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
<3.3.0Update to 3.3.0
- Critical9.8Arbitrary File Upload
Audio Record
≤1.0No patch available
- Critical9.8SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.21.1Update to 3.3.21.2
- High7.5PHP Object Injection via PHAR Deserialization
WP Job Manager
<1.31.3Update to 1.31.3
- Medium6.1Cross-Site Scripting
JSmol2WP
≤1.07No patch available
- Critical10.0Privilege Escalation
UserPro - Community and User Profile WordPress Plugin
<4.9.21Update to 4.9.21
- High8.8SQL injection
Booking Calendar
≤8.4.3Update to 8.4.4
- Medium6.1Cross-Site Scripting
Order XML File Export Import for WooCommerce
<1.2.3Update to 1.2.3
- High7.5Server-Side Request Forgery
JSmol2WP
≤1.07No patch available
- Medium5.5Authenticated Cross-Site Scripting
XML Sitemap Generator for Google
≤4.0.9Update to 4.1.0
- High8.8Cross-Site Request Forgery
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
<1.4.2Update to 1.4.2
- High8.8Cross-Site Request Forgery
Two Factor Authentication
<1.3.13Update to 1.3.13
- Critical9.1Remote Code Execution
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium5.5Cross-Site Scripting
Read and Understood
<2.2Update to 2.2
- High7.5Sensitive Information Disclosure
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium4.3Authorization Bypass
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High8.8PHP Object Injection
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.1WordPress Core < 5.0.1 Reflected Cross-Site Scripting
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1