VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1360)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,153 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1360)
SeverityVulnerabilityCVEInstallsPublished
Medium5.4Open Redirect
WordPress≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5
CVE-2018-10100—
Medium4.1Cross-Site Scripting via Shortcodes
Iptanus File Upload<4.3.3Update to 4.3.3
CVE-2018-9172—
Medium5.4Cross-Site Scripting
Relevanssi – A Better Search≤4.0.4Update to 4.0.5
CVE-2018-9034—
Medium6.5Cross-Site Request Forgery to Denial of Service
WP Image Zoom≤1.23Update to 1.24
CVE-2018-1000510—
Medium5.3Sensitive Information Disclosure
WP Activity Log≤3.1.1Update to 3.1.2
CVE-2018-8719—
Medium6.4Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.8.1.2Update to 5.8.1.2
CVE-2018-9020—
Critical9.8Local File Inclusion
Site Editor≤1.1.1No patch available
CVE-2018-7422—
Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More≤1.2.32Update to 1.2.33
CVE-2018-75431M+
Medium5.3Spam Injection
MailPoet Newsletters (Previous)≤2.8.1Update to 2.8.2
CVE-2018-20853—
Critical9.8Object Injection
Newsletters<4.6.8.6Update to 4.6.8.6
CVE-2018-20987—
High8.8Cross-Site Request Forgery
bbPress Move Topics<1.1.5Update to 1.1.5
CVE-2018-21006—
High8.8PHP Object Injection
bbPress Move Topics≤1.1.4Update to 1.1.6
CVE-2018-21005—
Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets<3.4.6Update to 3.4.6
CVE-2018-0546—
Medium6.1Multiple Cross-Site Scripting
Activity Log – Monitor User and Agent Changes≤2.4.0Update to 2.4.1
CVE-2018-8729—
Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets<3.4.7Update to 3.4.7
CVE-2018-0547—
Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets<3.4.7Update to 3.4.7
CVE-2018-20978—
Critical9.8Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard<1.2.0Update to 1.2.0
CVE-2018-8710—
Critical9.8Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard<1.2.0Update to 1.2.0
CVE-2018-8711—
High7.5Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection≤6.9.0Update to 6.9.1
CVE-2018-7433—
Critical9.8Authentication Bypass
Social Share, Social Login and Social Comments Plugin – Super Socializer≤7.10.6Update to 7.11
——
High7.5Information Disclosure
File Manager≤5.0.0Update to 5.0.2
CVE-2018-7204—
Critical9.8PHP Object Injection
WP Job Manager≤1.29.2Update to 1.29.3
——
High7.5Sensitive Information Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤2.2.46Update to 2.2.50
CVE-2018-7586—
Medium6.1Cross-Site Scripting
trust-form≤2.0.0Update to 2.0.1
CVE-2017-18613—
Medium6.1Custom Permalinks <= 1.1 -Cross-Site Scripting
Custom Permalinks≤1.1Update to 1.2
——
High7.5Parameter Tampering
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.2.15Update to 3.2.15
CVE-2018-20980—
High8.1Authenticated SQL Injection
Custom Permalinks≤1.1Update to 1.2
——
Critical9.8SQL Injection
WP Support Plus Responsive Ticket System≤9.0.2Update to 9.0.3
CVE-2018-1000131—
High7.4SQL Injection
WP Fastest Cache – WordPress Cache Plugin≤0.8.7.4Update to 0.8.7.5
——
High8.5Authenticated PHP Object Injection
Category Order and Taxonomy Terms Order<1.5.3Update to 1.5.3
——
  • Medium5.4
    Open Redirect

    WordPress

    ≤4.9.4Update to 3.7.26 or 3.8.26 or 3.9.24 or 4.0.23 or 4.1.23 or 4.2.20 or 4.3.16 or 4.4.15 or 4.5.14 or 4.6.11 or 4.7.10 or 4.8.6 or 4.9.5

    CVE-2018-10100

  • Medium4.1
    Cross-Site Scripting via Shortcodes

    Iptanus File Upload

    <4.3.3Update to 4.3.3

    CVE-2018-9172

  • Medium5.4
    Cross-Site Scripting

    Relevanssi – A Better Search

    ≤4.0.4Update to 4.0.5

    CVE-2018-9034

  • Medium6.5
    Cross-Site Request Forgery to Denial of Service

    WP Image Zoom

    ≤1.23Update to 1.24

    CVE-2018-1000510

  • Medium5.3
    Sensitive Information Disclosure

    WP Activity Log

    ≤3.1.1Update to 3.1.2

    CVE-2018-8719

  • Medium6.4
    Cross-Site Scripting

    Events Manager – Calendar, Bookings, Tickets, Appointments and more!

    <5.8.1.2Update to 5.8.1.2

    CVE-2018-9020

  • Critical9.8
    Local File Inclusion

    Site Editor

    ≤1.1.1No patch available

    CVE-2018-7422

  • Medium6.1
    Cross-Site Scripting

    Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

    ≤1.2.32Update to 1.2.33

    CVE-2018-75431M+

  • Medium5.3
    Spam Injection

    MailPoet Newsletters (Previous)

    ≤2.8.1Update to 2.8.2

    CVE-2018-20853

  • Critical9.8
    Object Injection

    Newsletters

    <4.6.8.6Update to 4.6.8.6

    CVE-2018-20987

  • High8.8
    Cross-Site Request Forgery

    bbPress Move Topics

    <1.1.5Update to 1.1.5

    CVE-2018-21006

  • High8.8
    PHP Object Injection

    bbPress Move Topics

    ≤1.1.4Update to 1.1.6

    CVE-2018-21005

  • Medium6.1
    Cross-Site Scripting

    WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

    <3.4.6Update to 3.4.6

    CVE-2018-0546

  • Medium6.1
    Multiple Cross-Site Scripting

    Activity Log – Monitor User and Agent Changes

    ≤2.4.0Update to 2.4.1

    CVE-2018-8729

  • Medium6.1
    Cross-Site Scripting

    WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

    <3.4.7Update to 3.4.7

    CVE-2018-0547

  • Medium6.1
    Cross-Site Scripting

    WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets

    <3.4.7Update to 3.4.7

    CVE-2018-20978

  • Critical9.8
    Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution

    HUSKY – Products Filter for WooCommerce Professional. MCP is onboard

    <1.2.0Update to 1.2.0

    CVE-2018-8710

  • Critical9.8
    Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion

    HUSKY – Products Filter for WooCommerce Professional. MCP is onboard

    <1.2.0Update to 1.2.0

    CVE-2018-8711

  • High7.5
    Cross-Site Scripting

    Kadence Security – Password, Two Factor Authentication, and Brute Force Protection

    ≤6.9.0Update to 6.9.1

    CVE-2018-7433

  • Critical9.8
    Authentication Bypass

    Social Share, Social Login and Social Comments Plugin – Super Socializer

    ≤7.10.6Update to 7.11

    cdbf2658-b819-4fd3-ac89-8b90a7e3a2cf

  • High7.5
    Information Disclosure

    File Manager

    ≤5.0.0Update to 5.0.2

    CVE-2018-7204

  • Critical9.8
    PHP Object Injection

    WP Job Manager

    ≤1.29.2Update to 1.29.3

    61e6db2f-5dfd-44ef-9500-9f0cb5cd67ba

  • High7.5
    Sensitive Information Disclosure

    Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

    ≤2.2.46Update to 2.2.50

    CVE-2018-7586

  • Medium6.1
    Cross-Site Scripting

    trust-form

    ≤2.0.0Update to 2.0.1

    CVE-2017-18613

  • Medium6.1
    Custom Permalinks <= 1.1 -Cross-Site Scripting

    Custom Permalinks

    ≤1.1Update to 1.2

    0d1a12b9-ac2e-4c60-8dd5-484944bb0ab8

  • High7.5
    Parameter Tampering

    Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

    <3.2.15Update to 3.2.15

    CVE-2018-20980

  • High8.1
    Authenticated SQL Injection

    Custom Permalinks

    ≤1.1Update to 1.2

    5c9a5613-770f-4294-997e-17fd5194ab70

  • Critical9.8
    SQL Injection

    WP Support Plus Responsive Ticket System

    ≤9.0.2Update to 9.0.3

    CVE-2018-1000131

  • High7.4
    SQL Injection

    WP Fastest Cache – WordPress Cache Plugin

    ≤0.8.7.4Update to 0.8.7.5

    65b3baaf-86e4-4dd2-b3eb-84c21eabdd6d

  • High8.5
    Authenticated PHP Object Injection

    Category Order and Taxonomy Terms Order

    <1.5.3Update to 1.5.3

    fe7e6a53-36c3-41fc-bae8-a9e1de2494ad

Search VulnCrest Radar

Jump to

Are you sure?