Database
WordPress Vulnerability Database (page 1364)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.1 | Cross-Site Scripting | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17744 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2017-17753 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2017-16949 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17719 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18015 | — | |
| Medium6.1 | Multiple Versions - Cross-Site Scripting | CVE-2017-17780 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-5316 | — | |
| Medium6.1 | Cross-Site Scripting | — | — | |
| High7.4 | SQL Injection | — | — | |
| High8.8 | Custom Registration Forms <= 3.8.0.4 - SQL Injection RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login≤3.8.0.4Update to 3.8.0.9 | — | — | |
| Medium6.1 | Custom Registration Forms <= 3.7.9.4 - Reflected Cross-Site Scripting RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login≤3.7.9.2Update to 3.8.0.9 | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18010 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18012 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-17451 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-20970 | — | |
| Critical9.8 | 21.2.7 - Authentication Bypass | — | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17092 | — | |
| Medium6.4 | WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17093 | — | |
| Medium5.4 | Authorization Bypass WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17091 | — | |
| Medium6.1 | Reflected Cross-Site Scripting WordPress≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1 | CVE-2017-17094 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18495 | — | |
| Medium6.1 | Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting | CVE-2017-18555 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-0511 | — | |
| High8.8 | Missing Authorization | CVE-2017-18596 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18489 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-16842 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18519 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-16955 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-17043 | — |
- High7.1Cross-Site Scripting
WP Site Protect
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Custom Map
≤1.1No patch available
- Medium5.4Cross-Site Scripting
CSV Import Export
≤1.1No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
accesspress-anonymous-post-pro
<3.2.0Update to 3.2.0
- Medium6.1Cross-Site Scripting
WP Concours
≤1.1No patch available
- Medium6.1Cross-Site Scripting
Share This Image
<1.04Update to 1.04
- Medium6.1Multiple Versions - Cross-Site Scripting
Clockwork SMS Notfications
≤2.0.3No patch available
- Medium6.1Cross-Site Scripting
SagePay Server Gateway for WooCommerce
<1.0.9Update to 1.0.9
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.3.67Update to 1.3.67
- High7.4SQL Injection
WebberZone Top 10 — Popular Posts
<2.4.4Update to 2.4.4
- High8.8Custom Registration Forms <= 3.8.0.4 - SQL Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤3.8.0.4Update to 3.8.0.9
- Medium6.1Custom Registration Forms <= 3.7.9.4 - Reflected Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤3.7.9.2Update to 3.8.0.9
- Medium6.1Cross-Site Scripting
Smart Marketing SMS and Newsletters Forms
<2.0.0Update to 2.0.0
- Medium6.1Cross-Site Scripting
Z-URL Preview
<2.0.0Update to 2.0.0
- Medium6.1Cross-Site Scripting
WP Mailster
<1.5.5Update to 1.5.5
- Medium6.1Reflected Cross-Site Scripting
PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin
<2.0.3Update to 2.0.3
- Critical9.821.2.7 - Authentication Bypass
Apocalypse Meow
21.1.3 – 21.2.7Update to 21.2.8
- Medium6.4Authenticated Stored Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium6.4WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium5.4Authorization Bypass
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium6.1Reflected Cross-Site Scripting
WordPress
≤4.9Update to 3.7.24 or 3.8.24 or 3.9.22 or 4.0.21 or 4.1.21 or 4.2.18 or 4.3.14 or 4.4.13 or 4.5.12 or 4.6.9 or 4.7.8 or 4.8.4 or 4.9.1
- Medium6.1Cross-Site Scripting
Clockwork SMS Notfications
<2.4.2Update to 2.4.2
- Medium6.1Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting
Booking Calendar – Clockwork SMS
≤1.0.5Update to 1.1.0
- Medium6.1Cross-Site Scripting
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
≤5.2.0Update to 5.2.2
- High8.8Missing Authorization
Elementor Website Builder – more than just a page builder
≤1.7.12Update to 1.8.0
- Medium6.1Reflected Cross-Site Scripting
Contact Form 7 – Clockwork SMS
<2.4.1Update to 2.4.1
- Medium6.1Reflected Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤5.7.1Update to 5.8.0
- Medium6.1Cross-Site Scripting
WP Customer Area
<7.4.3Update to 7.4.3
- High8.8Authenticated SQL Injection
inlinks
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Emag Marketplace Connector
<1.0.1Update to 1.0.1