VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1354)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,153 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1354)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Cross-Site Scripting
Weblizar Pin Feeds<1.1.2Update to 1.1.2
CVE-2018-5655—
High8.8Cross-Site Request Forgery
Weblizar Pin Feeds<1.1.2Update to 1.1.2
CVE-2018-5656—
Medium5.4Stored Cross-Site Scripting
Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs≤1.8.0Update to 2.0.0
CVE-2018-5312—
High8.8PHP Object Injection
Simple Link Directory – AI Powered≤5.6.0Update to 5.7.0
——
High7.3Improper REST Capabilities Checks
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More≤2.6.3Update to 2.6.4
——
Critical9.8Arbitrary Options Update
Social Sharing Plugin – Kiwi≤2.0.10Update to 2.0.11
——
Critical9.8SQL Injection
BuddyForms≤2.2.7Update to 2.2.8
CVE-2018-21003—
Medium6.1Open Redirect
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤3.0.12Update to 3.1.0
CVE-2018-16174—
High7.2Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤3.0.12Update to 3.1.0
CVE-2018-16175—
Medium6.1Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses≤3.0.12Update to 3.1.0
CVE-2018-16173—
Critical9.8Arbitrary Options Update and Action Calling
Cookie Information | Free GDPR Consent Solution<1.4.3Update to 1.4.3
CVE-2018-19207—
Critical9.8SQL Injection
RSVPMaker<5.6.4Update to 5.6.4
CVE-2018-21004—
Medium6.1Reflected Cross-Site Scripting
Better WordPress reCAPTCHA (with no CAPTCHA reCAPTCHA)≤2.0.3No patch available
——
High7.2WooCommerce File Deletion
WooCommerce<3.4.6Update to 3.4.6
CVE-2018-20714—
Medium6.6Race Condition to Remote Code Execution
Yoast SEO – Advanced SEO with real-time guidance and built-in AI≤9.1.0Update to 9.2.0
CVE-2018-19370—
Medium6.1Reflected Cross-Site Scripting
Media File Manager≤1.4.2Update to 1.4.3
CVE-2018-19041—
Medium6.1Cross-Site Scripting
Flow-Flow Social Feed & Social Wall<3.0.72Update to 3.0.72
——
Medium5.4Cross-Site Scripting
Event Calendar WD version≤1.1.21Update to 1.1.22
CVE-2018-16164—
Critical9.8Arbitrary File Upload
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership≤1.4.13Update to 1.4.14
CVE-2019-1010209—
Medium4.8Cross-Site Scripting
WP Editor.md – The Perfect WordPress Markdown Editor<10.0.4Update to 10.0.4
CVE-2018-18919—
Medium5.4Authenticated Stored Cross-Site Scripting
Calendar<1.3.11Update to 1.3.11
CVE-2018-18872—
Medium6.4Stored Cross-Site Scripting
Divi Builder≤2.17.2Update to 2.17.3
——
Critical9.8SQL Injection
Rockhoist Ratings<1.2.3Update to 1.2.3
——
Medium6.1Cross-Site Scripting
Elementor Website Builder Pro<2.0.10Update to 2.0.10
CVE-2018-18379—
High7.1Unauthenticated Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction<3.0.18Update to 3.0.18
——
High8.7Directory Traversal Allowing Arbitrary File Deletion
WP-DBManager<2.79.2Update to 2.79.2
——
Medium6.3Missing Authorization
AMP for WP – Accelerated Mobile Pages≤0.9.97.19Update to 0.9.97.20
——
Medium6.4Authenticated Stored Cross-Site Scripting
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)<2.10Update to 2.10
——
Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging≤8.0.15Update to 8.0.16
CVE-2018-18460—
Critical9.8Arbitrary File Upload
Arigato Autoresponder and Newsletterall versionsNo patch available
CVE-2018-18461—
  • Medium6.1
    Cross-Site Scripting

    Weblizar Pin Feeds

    <1.1.2Update to 1.1.2

    CVE-2018-5655

  • High8.8
    Cross-Site Request Forgery

    Weblizar Pin Feeds

    <1.1.2Update to 1.1.2

    CVE-2018-5656

  • Medium5.4
    Stored Cross-Site Scripting

    Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs

    ≤1.8.0Update to 2.0.0

    CVE-2018-5312

  • High8.8
    PHP Object Injection

    Simple Link Directory – AI Powered

    ≤5.6.0Update to 5.7.0

    bd302d8e-bba1-4fa1-bcbc-591d894ca1d6

  • High7.3
    Improper REST Capabilities Checks

    Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

    ≤2.6.3Update to 2.6.4

    f53e5192-e809-400c-aed9-36b5d6415a9d

  • Critical9.8
    Arbitrary Options Update

    Social Sharing Plugin – Kiwi

    ≤2.0.10Update to 2.0.11

    2f47a01d-b259-465e-bec1-9079987dc5a5

  • Critical9.8
    SQL Injection

    BuddyForms

    ≤2.2.7Update to 2.2.8

    CVE-2018-21003

  • Medium6.1
    Open Redirect

    LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

    ≤3.0.12Update to 3.1.0

    CVE-2018-16174

  • High7.2
    Authenticated SQL Injection

    LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

    ≤3.0.12Update to 3.1.0

    CVE-2018-16175

  • Medium6.1
    Cross-Site Scripting

    LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

    ≤3.0.12Update to 3.1.0

    CVE-2018-16173

  • Critical9.8
    Arbitrary Options Update and Action Calling

    Cookie Information | Free GDPR Consent Solution

    <1.4.3Update to 1.4.3

    CVE-2018-19207

  • Critical9.8
    SQL Injection

    RSVPMaker

    <5.6.4Update to 5.6.4

    CVE-2018-21004

  • Medium6.1
    Reflected Cross-Site Scripting

    Better WordPress reCAPTCHA (with no CAPTCHA reCAPTCHA)

    ≤2.0.3No patch available

    478723c4-cc45-4241-af45-21ee537f1dfa

  • High7.2
    WooCommerce File Deletion

    WooCommerce

    <3.4.6Update to 3.4.6

    CVE-2018-20714

  • Medium6.6
    Race Condition to Remote Code Execution

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    ≤9.1.0Update to 9.2.0

    CVE-2018-19370

  • Medium6.1
    Reflected Cross-Site Scripting

    Media File Manager

    ≤1.4.2Update to 1.4.3

    CVE-2018-19041

  • Medium6.1
    Cross-Site Scripting

    Flow-Flow Social Feed & Social Wall

    <3.0.72Update to 3.0.72

    74a33813-ca5a-4cf4-9d36-b71ca76b8915

  • Medium5.4
    Cross-Site Scripting

    Event Calendar WD version

    ≤1.1.21Update to 1.1.22

    CVE-2018-16164

  • Critical9.8
    Arbitrary File Upload

    GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership

    ≤1.4.13Update to 1.4.14

    CVE-2019-1010209

  • Medium4.8
    Cross-Site Scripting

    WP Editor.md – The Perfect WordPress Markdown Editor

    <10.0.4Update to 10.0.4

    CVE-2018-18919

  • Medium5.4
    Authenticated Stored Cross-Site Scripting

    Calendar

    <1.3.11Update to 1.3.11

    CVE-2018-18872

  • Medium6.4
    Stored Cross-Site Scripting

    Divi Builder

    ≤2.17.2Update to 2.17.3

    1295f1a0-1f5a-4707-96cc-c408a6819e87

  • Critical9.8
    SQL Injection

    Rockhoist Ratings

    <1.2.3Update to 1.2.3

    e8469ffc-477a-4ff1-853b-dcefba2b9c4e

  • Medium6.1
    Cross-Site Scripting

    Elementor Website Builder Pro

    <2.0.10Update to 2.0.10

    CVE-2018-18379

  • High7.1
    Unauthenticated Cross-Site Scripting

    Pie Register – User Registration, Profiles & Content Restriction

    <3.0.18Update to 3.0.18

    d7edb3be-ffa9-4e80-addf-5e5aca6050ef

  • High8.7
    Directory Traversal Allowing Arbitrary File Deletion

    WP-DBManager

    <2.79.2Update to 2.79.2

    52c24f18-832b-4416-a148-a23e38b257e0

  • Medium6.3
    Missing Authorization

    AMP for WP – Accelerated Mobile Pages

    ≤0.9.97.19Update to 0.9.97.20

    9ea2964f-9e3a-450b-9724-5a520c73d306

  • Medium6.4
    Authenticated Stored Cross-Site Scripting

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    <2.10Update to 2.10

    6a0c948b-7f14-450e-858a-77c1d3dd0761

  • Medium6.1
    Cross-Site Scripting

    3CX Free Live Chat, Calls & Messaging

    ≤8.0.15Update to 8.0.16

    CVE-2018-18460

  • Critical9.8
    Arbitrary File Upload

    Arigato Autoresponder and Newsletter

    all versionsNo patch available

    CVE-2018-18461

Search VulnCrest Radar

Jump to

Are you sure?