Database
WordPress Vulnerability Database (page 1357)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Insecure Deserialization | CVE-2017-1000600 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2018-14502 | — | |
| High8.6 | CSV Injection | CVE-2018-15571 | — | |
| Medium6.1 | Cross-Site Scripting | — | — | |
| High8.8 | Arbitrary File Upload | — | — | |
| Medium6.5 | Authenticated (Custom+) Arbitrary File Deletion | CVE-2018-25308 | — | |
| Medium6.6 | Authenticated(Administrator+) PHP File Upload WordPress≤6.4.2Update to 4.1.40 or 4.2.37 or 4.3.33 or 4.4.32 or 4.5.31 or 4.6.28 or 4.7.28 or 4.8.24 or 4.9.25 or 5.0.21 or 5.1.18 or 5.2.20 or 5.3.17 or 5.4.15 or 5.5.14 or 5.6.13 or 5.7.11 or 5.8.9 or 5.9.9 or 6.0.7 or 6.1.5 or 6.2.4 or 6.3.3 or 6.4.3 | CVE-2018-14028 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20966 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-17884 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2018-14846 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2018-17947 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-14430 | — | |
| Medium4.8 | Cross-Site Scripting | CVE-2018-13137 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-21001 | — | |
| Medium6.4 | < 1.10.4 - Cross-Site Scripting | CVE-2018-14071 | — | |
| High7.2 | Local File Inclusion | CVE-2018-1000504 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2018-13832 | — | |
| Critical9.1 | Insufficient Restrictions during Export Personal Data requests | CVE-2018-20981 | — | |
| High8.8 | Authenticated Arbitrary File Deletion WordPress≤4.9.6Update to 3.7.27 or 3.8.27 or 3.9.25 or 4.0.24 or 4.1.24 or 4.2.21 or 4.3.17 or 4.4.16 or 4.5.15 or 4.6.12 or 4.7.11 or 4.8.7 or 4.9.7 | CVE-2018-12895 | — | |
| Medium6.1 | Authenticated Cross-Site Scripting | CVE-2018-13136 | — | |
| Medium6.1 | 6.6.4 - Cross-Site Scripting | CVE-2018-0642 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11105 | — | |
| Medium6.5 | Unauthenticated Cross-Site Scripting | — | — | |
| High7.2 | Authenticated SQL Injection Kadence Security – Password, Two Factor Authentication, and Brute Force Protection<7.0.3Update to 7.0.3 | CVE-2018-12636 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-21002 | — | |
| Medium6.1 | CSV Injection | CVE-2018-11526 | — | |
| High7.8 | CSV Injection | CVE-2018-11525 | — | |
| Medium6.4 | Cross-Site Scripting | — | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-1000505 | — |
- High8.8Insecure Deserialization
WordPress
<4.9Update to 4.9
- Critical9.8Unauthenticated SQL Injection
Chained Quiz
<1.0.9Update to 1.0.9
- High8.6CSV Injection
Export Users to CSV
≤1.1.1No patch available
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.22Update to 2.0.22
- High8.8Arbitrary File Upload
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.22Update to 2.0.22
- Medium6.5Authenticated (Custom+) Arbitrary File Deletion
BuddyPress Xprofile Custom Fields Type
≤2.6.3No patch available
- Medium6.6Authenticated(Administrator+) PHP File Upload
WordPress
≤6.4.2Update to 4.1.40 or 4.2.37 or 4.3.33 or 4.4.32 or 4.5.31 or 4.6.28 or 4.7.28 or 4.8.24 or 4.9.25 or 5.0.21 or 5.1.18 or 5.2.20 or 5.3.17 or 5.4.15 or 5.5.14 or 5.6.13 or 5.7.11 or 5.8.9 or 5.9.9 or 6.0.7 or 6.1.5 or 6.2.4 or 6.3.3 or 6.4.3
- Medium6.1Cross-Site Scripting
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
<3.8.0Update to 3.8.0
- Medium6.1Cross-Site Scripting
Gwolle Guestbook
≤2.5.3Update to 2.5.4
- Medium6.4Stored Cross-Site Scripting
Multi Step Form
<1.2.6Update to 1.2.6
- Medium6.1Reflected Cross-Site Scripting
Strong Testimonials
≤2.31.4Update to 2.31.5
- Medium6.1Multiple Cross-Site Scripting
Snazzy Maps
≤1.1.4Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
Multi Step Form
<1.2.6Update to 1.2.6
- Medium4.8Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.4Update to 5.9.5
- Medium6.1Cross-Site Scripting
AnyComment
≤0.0.32Update to 0.0.33
- Medium6.4< 1.10.4 - Cross-Site Scripting
Geo Mashup
<1.10.4Update to 1.10.4
- High7.2Local File Inclusion
Redirection
≤2.7.3Update to 2.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
All In One Favicon
≤4.6Update to 4.7
- Critical9.1Insufficient Restrictions during Export Personal Data requests
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.8Update to 3.3.9
- High8.8Authenticated Arbitrary File Deletion
WordPress
≤4.9.6Update to 3.7.27 or 3.8.27 or 3.9.25 or 4.0.24 or 4.1.24 or 4.2.21 or 4.3.17 or 4.4.16 or 4.5.15 or 4.6.12 or 4.7.11 or 4.8.7 or 4.9.7
- Medium6.1Authenticated Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.17Update to 2.0.18
- Medium6.16.6.4 - Cross-Site Scripting
FV Flowplayer Video Player
6.1.2 – 6.6.4Update to 6.6.5
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.07Update to 8.0.08
- Medium6.5Unauthenticated Cross-Site Scripting
Social Preview and Open Graph Tags
<2.2.4.2Update to 2.2.4.2
- High7.2Authenticated SQL Injection
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
<7.0.3Update to 7.0.3
- High8.8Cross-Site Request Forgery
JS Help Desk – AI-Powered Support & Ticketing System
≤2.0.5Update to 2.0.6
- Medium6.1CSV Injection
Comments Import & Export
≤2.0.4Update to 2.0.5
- High7.8CSV Injection
Advanced Order Export For WooCommerce
≤1.5.4Update to 1.5.5
- Medium6.4Cross-Site Scripting
Contact Form for WordPress – Ultimate Form Builder Lite
≤1.3.7Update to 1.3.8
- Medium6.5Cross-Site Request Forgery
Tooltipy (tooltips for WP)
<5.1Update to 5.1