Database
WordPress Vulnerability Database (page 1367)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Authenticated SQL Injection | CVE-2017-14842 | — | |
| High8.8 | Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection | CVE-2017-14845 | — | |
| High8.8 | Authenticated (Student+) SQL Injection | CVE-2017-14843 | — | |
| Critical9.8 | SQL Injection | CVE-2017-14125 | — | |
| Medium5.3 | Directory Traversal | CVE-2017-15079 | — | |
| Critical9.8 | Authentication Bypass | CVE-2017-14766 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-14622 | — | |
| Critical9.8 | SQL Injection via Mishandled Placeholders WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14723 | — | |
| Low3.5 | Open Redirect in Admin Dashboard WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14725 | — | |
| Medium4.3 | Directory Traversal during unzip WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14719 | — | |
| Medium6.4 | Cross-Site Scripting in oEmbed WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14724 | — | |
| Medium6.4 | Cross-Site Scripting via Template Name WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14720 | — | |
| Medium6.4 | Cross-Site Scripting via Shortcodes WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14726 | — | |
| Medium4.9 | Directory Traversal via Customizer WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14722 | — | |
| Medium5.5 | Stored Cross-Site Scripting via Plugin Names WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14721 | — | |
| Medium6.4 | Cross-Site Scripting via Javascript: and Data: URLs WordPress≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2 | CVE-2017-14718 | — | |
| Critical9.8 | Remote Code Execution | — | — | |
| High7.5 | Arbitrary Settings Change | CVE-2017-18584 | — | |
| Critical9.8 | PHP Object Injection | CVE-2017-18583 | — | |
| Medium6.1 | Reflected Cross-site Scripting | CVE-2017-18599 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | — | — | |
| High8.8 | Human Resource Management System < 1.1 - SQL Injection | CVE-2017-14848 | — | |
| High7.5 | Unauthenticated Backup Download | CVE-2017-2551 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18577 | — | |
| Medium5.4 | Cross-Site Scripting | — | — | |
| Medium6.1 | Unauthorized Cross-Site Scripting | CVE-2017-14126 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18535 | — | |
| High7.4 | Authenticated Stored Cross-Site Scripting | — | — |
- High8.8Authenticated SQL Injection
SMSmaster – Multipurpose SMS Gateway for Wordpress
all versionsNo patch available
- High8.8Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection
WPCHURCH - Church Management System for Wordpress
<13-07-2019Update to 13-07-2019
- High8.8Authenticated (Student+) SQL Injection
School Management System for Wordpress
all versionsNo patch available
- Critical9.8SQL Injection
Gallery – Image and Video Gallery with Thumbnails
<1.2.1Update to 1.2.1
- Medium5.3Directory Traversal
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤2.7.5Update to 2.7.6
- Critical9.8Authentication Bypass
Student Result or Employee Database
≤1.6.3Update to 1.6.4
- Medium6.1Reflected Cross-Site Scripting
2kb Amazon Affiliates Store
<2.1.1Update to 2.1.1
- Critical9.8SQL Injection via Mishandled Placeholders
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Low3.5Open Redirect in Admin Dashboard
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium4.3Directory Traversal during unzip
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium6.4Cross-Site Scripting in oEmbed
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium6.4Cross-Site Scripting via Template Name
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium6.4Cross-Site Scripting via Shortcodes
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium4.9Directory Traversal via Customizer
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium5.5Stored Cross-Site Scripting via Plugin Names
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Medium6.4Cross-Site Scripting via Javascript: and Data: URLs
WordPress
≤4.8.1Update to 3.7.22 or 3.8.22 or 3.9.20 or 4.0.19 or 4.1.19 or 4.2.16 or 4.3.12 or 4.4.11 or 4.5.10 or 4.6.7 or 4.7.6 or 4.8.2
- Critical9.8Remote Code Execution
Jetpack VaultPress
≤1.9Update to 1.9.1
- High7.5Arbitrary Settings Change
Post Pay Counter
<2.731Update to 2.731
- Critical9.8PHP Object Injection
Post Pay Counter
<2.731Update to 2.731
- Medium6.1Reflected Cross-site Scripting
Pinfinity
≤1.9.2Update to 2.0
- High7.2Authenticated (Admin+) SQL Injection
Active Directory Integration
≤1.1.8No patch available
- High8.8Human Resource Management System < 1.1 - SQL Injection
WPHRM – Human Resource Management System for Wordpress | WordPress
<1.1Update to 1.1
- High7.5Unauthenticated Backup Download
BackWPup – WordPress Backup & Restore Plugin
<3.4.2Update to 3.4.2
- Medium6.1Cross-Site Scripting
MC4WP: Mailchimp for WordPress
≤4.1.7Update to 4.1.8
- Medium5.4Cross-Site Scripting
Caldera Forms – More Than Contact Forms
≤1.5.4Update to 1.5.5
- Medium6.1Unauthorized Cross-Site Scripting
Participants Database
≤1.7.5.9Update to 1.7.5.10
- Medium6.1Reflected Cross-Site Scripting
User Access Manager
<2.0.9Update to 2.0.9
- Medium6.1Reflected Cross-Site Scripting
User Access Manager
≤1.2.14Update to 2.0.0
- Medium6.1Cross-Site Scripting
SmokeSignal
≤1.2.6Update to 1.2.7
- High7.4Authenticated Stored Cross-Site Scripting
SmokeSignal
<1.2.7Update to 1.2.7