Database

WordPress Vulnerability Database (page 1363)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

WordPress Vulnerability Database (page 1363)
Severity	Vulnerability	CVE	Installs	Published
High8.8	SQL Injection Testimonial Slider<1.2.5Update to 1.2.5	CVE-2018-5372	—	Jan 10, 2018
High8.8	Authenticated SQL Injection Smooth Slider<2.8.7Update to 2.8.7	CVE-2018-5373	—	Jan 10, 2018
Critical9.8	SQL Injection WP Events Calendar Plugin≤1.0Update to 1.1	CVE-2018-5315	—	Jan 9, 2018
Medium6.3	Cross-Site Request Forgery Download Manager≤2.9.6Update to 2.9.61	—	—	Jan 9, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5290	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5287	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5291	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5286	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5293	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5288	—	Jan 8, 2018
Medium6.1	Cross-Site Scripting GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5292	—	Jan 8, 2018
High7.5	Directory Traversal GD Rating System<2.3.1Update to 2.3.1	CVE-2018-5289	—	Jan 8, 2018
High7.2	SQL Injection WP Job Board<4.5Update to 4.5	CVE-2018-5695	—	Jan 6, 2018
High7.5	Arbitrary File Upload LearnDash LMS<2.5.4Update to 2.5.4	CVE-2018-25019	—	Jan 6, 2018
Medium6.3	Unauthenticated SQL Injection NebulaX Theme<5.0Update to 5.0	CVE-2018-25106	—	Jan 4, 2018
High8.8	Cross-Site Request Forgery ImageInject≤1.15Update to 1.16	CVE-2018-5285	—	Jan 4, 2018
Medium5.4	Stored Cross-Site Scripting Add Link to Facebook≤2.3No patch available	CVE-2018-5214	—	Jan 4, 2018
Medium6.1	Cross-Site Scripting ImageInject≤1.15Update to 1.16	CVE-2018-5284	—	Jan 4, 2018
Medium6.5	Arbitrary File Deletion BuddyPress Xprofile Custom Fields Type≤2.6.3No patch available	—	—	Jan 4, 2018
High8.8	Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter Social Media Widget by Acurax<3.2.6Update to 3.2.6	CVE-2018-6357	—	Jan 2, 2018
Medium5.4	Authenticated Stored Cross-Site Scripting Simple Download Monitor<3.5.4Update to 3.5.4	CVE-2018-5213	—	Jan 2, 2018
Medium6.4	Authenticated Stored Cross-Site Scripting Simple Download Monitor<3.5.4Update to 3.5.4	CVE-2018-5212	—	Jan 2, 2018
High7.2	Stored Cross-Site Scripting Smart Google Code Inserter<3.5Update to 3.5	CVE-2018-3810	—	Jan 1, 2018
Medium6.1	Open Redirect furikake≤0.1.0Update to 0.1.1	CVE-2017-1000434	—	Jan 1, 2018
Critical9.8	Unauthenticated SQL Injection Smart Google Code Inserter<3.5Update to 3.5	CVE-2018-3811	—	Jan 1, 2018
Medium5.3	2.3.0 - Backdoor No Follow All External Links2.1.0 – 2.3.0No patch available	—	—	Dec 28, 2017
Critical9.8	Malicious Backdoor Duplicate Page and Post≤2.1.1No patch available	—	—	Dec 27, 2017
Medium6.4	Arbitrary File Deletion Woocommerce CSV importer≤3.3.6Update to 3.4.0	—	—	Dec 27, 2017
Medium6.1	Cross-Site Scripting mgl-instagram-galleryall versionsNo patch available	CVE-2017-17869	—	Dec 22, 2017
Critical9.6	4.4.4 - Plugin Backdoor Captcha4.3.6 – 4.4.4Update to 4.4.5	—	—	Dec 19, 2017

High8.8
SQL Injection
Testimonial Slider
<1.2.5Update to 1.2.5
CVE-2018-5372Jan 10, 2018
High8.8
Authenticated SQL Injection
Smooth Slider
<2.8.7Update to 2.8.7
CVE-2018-5373Jan 10, 2018
Critical9.8
SQL Injection
WP Events Calendar Plugin
≤1.0Update to 1.1
CVE-2018-5315Jan 9, 2018
Medium6.3
Cross-Site Request Forgery
Download Manager
≤2.9.6Update to 2.9.61
79b5883b-a3be-497e-b911-7dc39e7fb418Jan 9, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5290Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5287Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5291Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5286Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5293Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5288Jan 8, 2018
Medium6.1
Cross-Site Scripting
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5292Jan 8, 2018
High7.5
Directory Traversal
GD Rating System
<2.3.1Update to 2.3.1
CVE-2018-5289Jan 8, 2018
High7.2
SQL Injection
WP Job Board
<4.5Update to 4.5
CVE-2018-5695Jan 6, 2018
High7.5
Arbitrary File Upload
LearnDash LMS
<2.5.4Update to 2.5.4
CVE-2018-25019Jan 6, 2018
Medium6.3
Unauthenticated SQL Injection
NebulaX Theme
<5.0Update to 5.0
CVE-2018-25106Jan 4, 2018
High8.8
Cross-Site Request Forgery
ImageInject
≤1.15Update to 1.16
CVE-2018-5285Jan 4, 2018
Medium5.4
Stored Cross-Site Scripting
Add Link to Facebook
≤2.3No patch available
CVE-2018-5214Jan 4, 2018
Medium6.1
Cross-Site Scripting
ImageInject
≤1.15Update to 1.16
CVE-2018-5284Jan 4, 2018
Medium6.5
Arbitrary File Deletion
BuddyPress Xprofile Custom Fields Type
≤2.6.3No patch available
dcd463de-ae26-4477-89e1-21f4aada1e86Jan 4, 2018
High8.8
Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter
Social Media Widget by Acurax
<3.2.6Update to 3.2.6
CVE-2018-6357Jan 2, 2018
Medium5.4
Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
CVE-2018-5213Jan 2, 2018
Medium6.4
Authenticated Stored Cross-Site Scripting
Simple Download Monitor
<3.5.4Update to 3.5.4
CVE-2018-5212Jan 2, 2018
High7.2
Stored Cross-Site Scripting
Smart Google Code Inserter
<3.5Update to 3.5
CVE-2018-3810Jan 1, 2018
Medium6.1
Open Redirect
furikake
≤0.1.0Update to 0.1.1
CVE-2017-1000434Jan 1, 2018
Critical9.8
Unauthenticated SQL Injection
Smart Google Code Inserter
<3.5Update to 3.5
CVE-2018-3811Jan 1, 2018
Medium5.3
2.3.0 - Backdoor
No Follow All External Links
2.1.0 – 2.3.0No patch available
db565c28-84ae-4b70-a56e-e91c1a27341dDec 28, 2017
Critical9.8
Malicious Backdoor
Duplicate Page and Post
≤2.1.1No patch available
113554f9-b8f0-4bdd-be90-0093fb520022Dec 27, 2017
Medium6.4
Arbitrary File Deletion
Woocommerce CSV importer
≤3.3.6Update to 3.4.0
86c0f530-bf4c-4de4-84db-e8469cea76c5Dec 27, 2017
Medium6.1
Cross-Site Scripting
mgl-instagram-gallery
all versionsNo patch available
CVE-2017-17869Dec 22, 2017
Critical9.6
4.4.4 - Plugin Backdoor
Captcha
4.3.6 – 4.4.4Update to 4.4.5
cacd31bd-ccc6-49fa-89f1-09f3c5cd9072Dec 19, 2017