Database
WordPress Vulnerability Database (page 1359)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Directory Traversal to Directory Listing | CVE-2018-19040 | — | |
| Medium4.3 | Insecure Direct Object Reference | CVE-2018-0590 | — | |
| Medium4.3 | Authenticated Unrestricted File Upload | CVE-2018-0587 | — | |
| Medium6.5 | Authorization Bypass | CVE-2018-11244 | — | |
| Medium4.3 | Directory Traversal | CVE-2018-0588 | — | |
| High7.5 | Remote Code Execution | CVE-2018-20988 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2018-10752 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-10371 | — | |
| High7.8 | CSV Injection | CVE-2018-10504 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2018-0576 | — | |
| Medium5.4 | Reflected Cross-Site Scripting | CVE-2018-0578 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2018-0577 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-0579 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2018-10309 | — | |
| High8.8 | Multiple Cross-Site Request Forgery Issues | CVE-2018-10233 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Cross-site scripting | CVE-2018-10300 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-10301 | — | |
| Medium5.5 | Authenticated Cross-Site Scripting | CVE-2018-10234 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2018-10310 | — | |
| Medium5.5 | Cross Site Scripting | CVE-2018-7747 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20004 | — | |
| High8.7 | Authenticated (Admin+) SQL Injection | — | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2018-9864 | — | |
| High8.6 | CSV Injection | CVE-2018-9035 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2018-9844 | — | |
| High7.5 | Directory Traversal | CVE-2018-9118 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | — | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting via Generator Tag WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5 | CVE-2018-10102 | — | |
| Medium4.3 | Security Misconfiguration with URL Hostnames WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5 | CVE-2018-10101 | — |
- Medium5.3Directory Traversal to Directory Listing
Media File Manager
≤1.4.2Update to 1.4.3
- Medium4.3Insecure Direct Object Reference
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium4.3Authenticated Unrestricted File Upload
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium6.5Authorization Bypass
BBE
<1.53Update to 1.53
- Medium4.3Directory Traversal
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High7.5Remote Code Execution
Google Forms
<0.94Update to 0.94
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Tagregator
≤0.6No patch available
- Medium6.1Cross-Site Scripting
WF Cookie Consent
<1.1.4Update to 1.1.4
- High7.8CSV Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
<1.12.22Update to 1.12.22
- Medium5.4Stored Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.9Update to 5.9
- Medium5.4Reflected Cross-Site Scripting
PixelYourSite – Your smart PIXEL (TAG) & API Manager
<5.3.0Update to 5.3.0
- Medium5.4Cross-Site Scripting
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<4.0.4Update to 4.0.4
- Medium6.1Reflected Cross-Site Scripting
Social Preview and Open Graph Tags
<2.2.4.1Update to 2.2.4.1
- Medium5.4Cross-Site Scripting
Responsive Cookie Consent
<1.8Update to 1.8
- High8.8Multiple Cross-Site Request Forgery Issues
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.7Update to 2.0.7
- Medium6.1Reflected Cross-Site Scripting
VRView
≤1.1.3No patch available
- Medium6.1Cross-site scripting
10WebSocial
<1.3.1Update to 1.3.1
- Medium6.1Cross-Site Scripting
WD Instagram Feed Premium
≤1.3.0Update to 1.3.1
- Medium5.5Authenticated Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.11Update to 2.0.11
- Medium6.4Stored Cross-Site Scripting
Termly – GDPR/CCPA Cookie Consent Banner
≤2.3.9Update to 2.3.10
- Medium5.5Cross Site Scripting
Caldera Forms – More Than Contact Forms
≤1.5.9.1Update to 1.6.0
- Medium6.1Reflected Cross-Site Scripting
Knews Multilingual Newsletters
≤1.1.0Update to 1.1.1
- High8.7Authenticated (Admin+) SQL Injection
Relevanssi – A Better Search
<3.6.1Update to 3.6.1
- Medium6.1Stored Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.05Update to 8.0.06
- High8.6CSV Injection
Contact Form DB
2.10.32 – 2.10.32Update to 2.10.36
- Medium6.1Stored Cross-Site Scripting
Iptanus File Upload
<4.3.4Update to 4.3.4
- High7.5Directory Traversal
WP Background Takeover
≤4.1.4Update to 4.1.5
- Medium6.4Authenticated Stored Cross-Site Scripting
My Calendar – Accessible Event Manager
<2.5.17Update to 2.5.17
- Medium6.4Authenticated Stored Cross-Site Scripting via Generator Tag
WordPress
≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
- Medium4.3Security Misconfiguration with URL Hostnames
WordPress
≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5