Database

WordPress Vulnerability Database (page 1365)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

WordPress Vulnerability Database (page 1365)
Severity	Vulnerability	CVE	Installs	Published
Medium5.4	Cross-Site Scripting amtyThumb posts≤8.2.0No patch available	CVE-2017-17059	—	Nov 18, 2017
High8.8	Authenticated PHP Object Injection WooCommerce<3.2.4Update to 3.2.4	CVE-2017-18356	—	Nov 16, 2017
High7.1	Cross-Site Scripting AMP Toolbox≤2.1.1No patch available	—	—	Nov 14, 2017
Medium6.4	Stored Cross-Site Scripting Affiliate Ads for Clickbank Products≤1.6Update to 1.7	CVE-2017-18011	—	Nov 14, 2017
High8.3	Unauthenticated Blind SQL Injection bbPress<2.5.13Update to 2.5.13	—	—	Nov 13, 2017
High8.6	SQL Injection Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder<2.05.03Update to 2.05.03	—	—	Nov 13, 2017
High8.3	Unauthenticated Stored Cross-Site Scripting Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder<2.05.03Update to 2.05.03	CVE-2017-20192	—	Nov 13, 2017
Medium6.1	Reflected Cross-Site Scripting Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder<2.05.03Update to 2.05.03	—	—	Nov 13, 2017
Medium5.3	Unauthenticated Information Disclosure Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder<2.05.03Update to 2.05.03	CVE-2017-20194	—	Nov 12, 2017
Medium6.4	Cross-Site Scripting WP Mail Logging≤1.8.2Update to 1.8.3	—	—	Nov 11, 2017
Medium6.4	Stored Cross-Site Scripting Email Log≤2.2.2Update to 2.2.3	—	—	Nov 11, 2017
High8.8	Arbitrary File Upload WP Support Plus Responsive Ticket System<8.0.8Update to 8.0.8	—	—	Nov 11, 2017
Critical9.8	Authentication Bypass UserPro - Community and User Profile WordPress Plugin<4.9.17.1Update to 4.9.17.1	CVE-2017-16562	—	Nov 10, 2017
Medium6.1	Cross-Site Scripting Simple Membership<3.5.7Update to 3.5.7	CVE-2017-18499	—	Nov 8, 2017
Medium6.1	Reflected Cross-Site Scripting Ultimate Instagram Feed – WordPress Plugin<1.3Update to 1.3	CVE-2017-16758	—	Nov 8, 2017
Medium6.1	Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More≤1.2.28Update to 1.2.30	CVE-2017-16815	1M+	Nov 7, 2017
Medium6.1	Cross-Site Scripting Content Cards≤0.9.6Update to 0.9.7	CVE-2017-17096	—	Nov 6, 2017
Medium6.1	WordPress Plugin < 1.3.1 - Cross-Site Scripting Ultimate Instagram Feed – WordPress Plugin≤1.3Update to 1.3.1	—	—	Nov 6, 2017
High8.8	SQL Injection JTRT Responsive Tables<4.1.2Update to 4.1.2	CVE-2017-18597	—	Nov 3, 2017
Medium6.1	Cross-Site Scripting Football Pool<2.6.5Update to 2.6.5	CVE-2017-18524	—	Nov 3, 2017
High7.2	SQL Injection Events≤2.3.4No patch available	—	—	Nov 3, 2017
High7.2	Authenticated (Admin+) SQL Injection Simple Events Calendar<1.3.6Update to 1.3.6	—	—	Nov 3, 2017
Medium6.5	Arbitrary Settings Change Like Button Rating ♥ LikeBtn≤2.5.3Update to 2.5.4	—	—	Nov 2, 2017
Critical9.8	SQL Injection due to Double Prepare approach WordPress≤4.8.2Update to 3.7.23 or 3.8.23 or 3.9.21 or 4.0.20 or 4.1.20 or 4.2.17 or 4.3.13 or 4.4.12 or 4.5.11 or 4.6.8 or 4.7.7 or 4.8.3	CVE-2017-16510	—	Oct 31, 2017
High8.8	Authenticated Remote Code Execution Shortcodes Ultimate – Content Elements<5.0.1Update to 5.0.1	CVE-2017-18580	—	Oct 31, 2017
Medium5.3	Sensitive Information Disclosure Rating-Widget: Star Review System<2.9.0Update to 2.9.0	—	—	Oct 30, 2017
Medium6.1	Cross-Site Scripting User Login History<1.6Update to 1.6	CVE-2017-15867	—	Oct 26, 2017
High8.0	CSV Injection wordcamp-talks<1.0.0-beta3Update to 1.0.0-beta3	—	—	Oct 23, 2017
Critical9.8	SQL Injection to PHP Object Injection Contact Form for WordPress – Ultimate Form Builder Lite<1.3.7Update to 1.3.7	CVE-2017-15919	—	Oct 23, 2017
Medium4.3	Missing Authorization Checks CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree<1.4Update to 1.4	—	—	Oct 20, 2017

Medium5.4
Cross-Site Scripting
amtyThumb posts
≤8.2.0No patch available
CVE-2017-17059Nov 18, 2017
High8.8
Authenticated PHP Object Injection
WooCommerce
<3.2.4Update to 3.2.4
CVE-2017-18356Nov 16, 2017
High7.1
Cross-Site Scripting
AMP Toolbox
≤2.1.1No patch available
a0413f69-7251-4c01-b2e0-c8638d797652Nov 14, 2017
Medium6.4
Stored Cross-Site Scripting
Affiliate Ads for Clickbank Products
≤1.6Update to 1.7
CVE-2017-18011Nov 14, 2017
High8.3
Unauthenticated Blind SQL Injection
bbPress
<2.5.13Update to 2.5.13
5097da41-b5e9-4e07-a135-83a7d889fe9bNov 13, 2017
High8.6
SQL Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
27616d9e-c1eb-489f-ace7-76c0e5be2597Nov 13, 2017
High8.3
Unauthenticated Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
CVE-2017-20192Nov 13, 2017
Medium6.1
Reflected Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
c0e6f20a-3a5c-4782-9852-9891b93d765fNov 13, 2017
Medium5.3
Unauthenticated Information Disclosure
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
CVE-2017-20194Nov 12, 2017
Medium6.4
Cross-Site Scripting
WP Mail Logging
≤1.8.2Update to 1.8.3
5c8a4708-eb74-45e1-ba47-e245491a8c2fNov 11, 2017
Medium6.4
Stored Cross-Site Scripting
Email Log
≤2.2.2Update to 2.2.3
3cf570e4-7cae-4adc-ac3e-84225d74da39Nov 11, 2017
High8.8
Arbitrary File Upload
WP Support Plus Responsive Ticket System
<8.0.8Update to 8.0.8
1de36458-d7e5-43cf-af40-0fd7a6eea5bbNov 11, 2017
Critical9.8
Authentication Bypass
UserPro - Community and User Profile WordPress Plugin
<4.9.17.1Update to 4.9.17.1
CVE-2017-16562Nov 10, 2017
Medium6.1
Cross-Site Scripting
Simple Membership
<3.5.7Update to 3.5.7
CVE-2017-18499Nov 8, 2017
Medium6.1
Reflected Cross-Site Scripting
Ultimate Instagram Feed – WordPress Plugin
<1.3Update to 1.3
CVE-2017-16758Nov 8, 2017
Medium6.1
Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.28Update to 1.2.30
CVE-2017-168151M+Nov 7, 2017
Medium6.1
Cross-Site Scripting
Content Cards
≤0.9.6Update to 0.9.7
CVE-2017-17096Nov 6, 2017
Medium6.1
WordPress Plugin < 1.3.1 - Cross-Site Scripting
Ultimate Instagram Feed – WordPress Plugin
≤1.3Update to 1.3.1
d2aea3e1-60cb-4992-a217-4250bed2641eNov 6, 2017
High8.8
SQL Injection
JTRT Responsive Tables
<4.1.2Update to 4.1.2
CVE-2017-18597Nov 3, 2017
Medium6.1
Cross-Site Scripting
Football Pool
<2.6.5Update to 2.6.5
CVE-2017-18524Nov 3, 2017
High7.2
SQL Injection
Events
≤2.3.4No patch available
2330005e-c3ab-4556-aba9-f194a1ace329Nov 3, 2017
High7.2
Authenticated (Admin+) SQL Injection
Simple Events Calendar
<1.3.6Update to 1.3.6
fff9fee5-3dca-447d-b7a8-981a5818ec12Nov 3, 2017
Medium6.5
Arbitrary Settings Change
Like Button Rating ♥ LikeBtn
≤2.5.3Update to 2.5.4
227886e8-99d9-49b3-a1a8-b06b02d331bcNov 2, 2017
Critical9.8
SQL Injection due to Double Prepare approach
WordPress
≤4.8.2Update to 3.7.23 or 3.8.23 or 3.9.21 or 4.0.20 or 4.1.20 or 4.2.17 or 4.3.13 or 4.4.12 or 4.5.11 or 4.6.8 or 4.7.7 or 4.8.3
CVE-2017-16510Oct 31, 2017
High8.8
Authenticated Remote Code Execution
Shortcodes Ultimate – Content Elements
<5.0.1Update to 5.0.1
CVE-2017-18580Oct 31, 2017
Medium5.3
Sensitive Information Disclosure
Rating-Widget: Star Review System
<2.9.0Update to 2.9.0
9b780e28-3254-49d8-9b62-ade1c0a42d8aOct 30, 2017
Medium6.1
Cross-Site Scripting
User Login History
<1.6Update to 1.6
CVE-2017-15867Oct 26, 2017
High8.0
CSV Injection
wordcamp-talks
<1.0.0-beta3Update to 1.0.0-beta3
48f148ee-800d-4c8f-bf43-893ec7961f3aOct 23, 2017
Critical9.8
SQL Injection to PHP Object Injection
Contact Form for WordPress – Ultimate Form Builder Lite
<1.3.7Update to 1.3.7
CVE-2017-15919Oct 23, 2017
Medium4.3
Missing Authorization Checks
CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree
<1.4Update to 1.4
13d16955-056d-45c5-b0d1-891767e866b2Oct 20, 2017