Database

WordPress Vulnerability Database (page 1368)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

WordPress Vulnerability Database (page 1368)
Severity	Vulnerability	CVE	Installs	Published
High8.8	SQL Execution SQL Shortcode≤1.1No patch available	—	—	Sep 2, 2017
High8.8	Cross-Site Request Forgery Jayj Quicktag<1.3.2Update to 1.3.2	CVE-2017-18546	—	Aug 28, 2017
High7.4	Authenticated Stored Cross-Site Scripting FG Joomla to WordPress<3.31.0Update to 3.31.0	—	—	Aug 24, 2017
Medium6.1	Reflected Cross-Site Scripting JetBackup – Backup, Restore & Migrate≤1.1.46Update to 1.1.47	CVE-2017-10837	—	Aug 24, 2017
Medium6.1	Cross-Site Scripting FG PrestaShop to WooCommerce≤3.19.1Update to 3.20.0	—	—	Aug 24, 2017
Medium6.1	Reflected Cross-Site Scripting Share on Diaspora<0.7.2Update to 0.7.2	CVE-2017-18534	—	Aug 23, 2017
Medium4.7	Reflected Cross Site Scripting Product Vendors<2.0.36Update to 2.0.36	CVE-2017-20193	—	Aug 22, 2017
Medium6.1	Cross-Site Scripting Contact Form, Drag and Drop Form Builder Plugin – Live Forms<3.4.0Update to 3.4.0	CVE-2017-18497	—	Aug 21, 2017
High7.2	Authenticated SQL Injection via tag_id Parameter Photo Gallery by 10Web – Mobile-Friendly Image Gallery<1.3.51Update to 1.3.51	CVE-2017-12977	—	Aug 20, 2017
Medium6.1	Cross-Site Scripting WP Job Board≤4.5.1Update to 5.0	CVE-2017-15375	—	Aug 18, 2017
Medium4.7	HTTP Host Header Injection AddToAny Share Buttons≤1.7.14Update to 1.7.15	—	—	Aug 16, 2017
Medium6.1	Cross-Site Scripting Embed Images in Comments<0.6Update to 0.6	CVE-2017-18561	—	Aug 16, 2017
High7.2	Link Library <= 5.9.13.26 – SQL Injection Link Library≤5.9.13.26Update to 5.9.13.27	—	—	Aug 14, 2017
Medium6.1	Cross-Site Scripting JetBackup – Backup, Restore & Migrate<1.1.47Update to 1.1.47	CVE-2017-18488	—	Aug 11, 2017
Medium6.1	Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting Bridge - Creative Multipurpose WordPress Theme<11.2Update to 11.2	CVE-2017-13138	—	Aug 8, 2017
Medium5.4	Stored Cross-Site Scripting UpdraftPlus Premium≤1.13.4Update to 1.13.5	CVE-2017-18593	—	Aug 8, 2017
High8.8	Cross-Site Request Forgery Loginizer<1.3.6Update to 1.3.6	CVE-2017-12651	—	Aug 8, 2017
Critical9.8	Blind SQL Injection Loginizer<1.3.6Update to 1.3.6	CVE-2017-12650	—	Aug 8, 2017
High7.2	Authenticated (Admin+) SQL Injection Easy Modal<2.1.0Update to 2.1.0	CVE-2017-12946	—	Aug 7, 2017
Critical9.8	Unauthenticated Arbitrary File Upload JQuery Html5 File Upload≤3.0No patch available	—	—	Aug 7, 2017
High7.2	SQL Injection Easy Modal<2.1.0Update to 2.1.0	CVE-2017-12947	—	Aug 7, 2017
Medium6.5	Unauthenticated Settings Update JQuery Html5 File Upload≤3.0No patch available	—	—	Aug 7, 2017
High8.0	Authenticated SQL Injection Podlove Podcast Publisher<2.6.0Update to 2.6.0	CVE-2017-12949	—	Aug 7, 2017
Medium6.1	Cross-Site Scripting PressForward<5.2.4Update to 5.2.4	CVE-2017-12948	—	Aug 7, 2017
High8.8	SQL Injection RK Responsive Contact Form≤1.0.0No patch available	CVE-2017-1002027	—	Aug 5, 2017
Medium6.1	Event and Gym Fitness WordPress Theme <= 1.6.4 - Reflected Cross-Site Scripting Gameplan - Event and Gym Fitness WordPress Theme≤1.6.4No patch available	CVE-2018-11568	—	Aug 4, 2017
Medium6.1	Cross-Site Scripting 3CX Free Live Chat, Calls & Messaging≤7.1.04Update to 7.1.05	CVE-2017-18507	—	Aug 2, 2017
Critical9.8	SQL Injection Ultimate Product Catalog≤4.2.22Update to 4.2.23	CVE-2017-12199	—	Aug 1, 2017
Medium6.1	Cross-Site Scripting Ultimate Product Catalog≤4.2.11Update to 4.2.12	CVE-2017-12200	—	Aug 1, 2017
Medium6.1	Cross-Site Scripting Easy Testimonials≤3.0.4No patch available	CVE-2017-12131	—	Jul 31, 2017

High8.8
SQL Execution
SQL Shortcode
≤1.1No patch available
8c78e14b-6925-4630-b19c-13b192f9fea3Sep 2, 2017
High8.8
Cross-Site Request Forgery
Jayj Quicktag
<1.3.2Update to 1.3.2
CVE-2017-18546Aug 28, 2017
High7.4
Authenticated Stored Cross-Site Scripting
FG Joomla to WordPress
<3.31.0Update to 3.31.0
8806a1b7-03c9-40a8-a1ef-f122329e0443Aug 24, 2017
Medium6.1
Reflected Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
≤1.1.46Update to 1.1.47
CVE-2017-10837Aug 24, 2017
Medium6.1
Cross-Site Scripting
FG PrestaShop to WooCommerce
≤3.19.1Update to 3.20.0
d5e70f6f-fc83-4c89-a1d5-35f188e0fd90Aug 24, 2017
Medium6.1
Reflected Cross-Site Scripting
Share on Diaspora
<0.7.2Update to 0.7.2
CVE-2017-18534Aug 23, 2017
Medium4.7
Reflected Cross Site Scripting
Product Vendors
<2.0.36Update to 2.0.36
CVE-2017-20193Aug 22, 2017
Medium6.1
Cross-Site Scripting
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.4.0Update to 3.4.0
CVE-2017-18497Aug 21, 2017
High7.2
Authenticated SQL Injection via tag_id Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.3.51Update to 1.3.51
CVE-2017-12977Aug 20, 2017
Medium6.1
Cross-Site Scripting
WP Job Board
≤4.5.1Update to 5.0
CVE-2017-15375Aug 18, 2017
Medium4.7
HTTP Host Header Injection
AddToAny Share Buttons
≤1.7.14Update to 1.7.15
7cc86970-7e63-47d0-9971-ddd0fc992a5aAug 16, 2017
Medium6.1
Cross-Site Scripting
Embed Images in Comments
<0.6Update to 0.6
CVE-2017-18561Aug 16, 2017
High7.2
Link Library <= 5.9.13.26 – SQL Injection
Link Library
≤5.9.13.26Update to 5.9.13.27
6755c415-427e-4572-908c-061ab8f7490aAug 14, 2017
Medium6.1
Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
<1.1.47Update to 1.1.47
CVE-2017-18488Aug 11, 2017
Medium6.1
Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting
Bridge - Creative Multipurpose WordPress Theme
<11.2Update to 11.2
CVE-2017-13138Aug 8, 2017
Medium5.4
Stored Cross-Site Scripting
UpdraftPlus Premium
≤1.13.4Update to 1.13.5
CVE-2017-18593Aug 8, 2017
High8.8
Cross-Site Request Forgery
Loginizer
<1.3.6Update to 1.3.6
CVE-2017-12651Aug 8, 2017
Critical9.8
Blind SQL Injection
Loginizer
<1.3.6Update to 1.3.6
CVE-2017-12650Aug 8, 2017
High7.2
Authenticated (Admin+) SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
CVE-2017-12946Aug 7, 2017
Critical9.8
Unauthenticated Arbitrary File Upload
JQuery Html5 File Upload
≤3.0No patch available
f107a2be-e75b-43f3-8d41-b68c50c27f55Aug 7, 2017
High7.2
SQL Injection
Easy Modal
<2.1.0Update to 2.1.0
CVE-2017-12947Aug 7, 2017
Medium6.5
Unauthenticated Settings Update
JQuery Html5 File Upload
≤3.0No patch available
7c312478-0d6e-400b-81c2-172c2c5798ffAug 7, 2017
High8.0
Authenticated SQL Injection
Podlove Podcast Publisher
<2.6.0Update to 2.6.0
CVE-2017-12949Aug 7, 2017
Medium6.1
Cross-Site Scripting
PressForward
<5.2.4Update to 5.2.4
CVE-2017-12948Aug 7, 2017
High8.8
SQL Injection
RK Responsive Contact Form
≤1.0.0No patch available
CVE-2017-1002027Aug 5, 2017
Medium6.1
Event and Gym Fitness WordPress Theme <= 1.6.4 - Reflected Cross-Site Scripting
Gameplan - Event and Gym Fitness WordPress Theme
≤1.6.4No patch available
CVE-2018-11568Aug 4, 2017
Medium6.1
Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.1.04Update to 7.1.05
CVE-2017-18507Aug 2, 2017
Critical9.8
SQL Injection
Ultimate Product Catalog
≤4.2.22Update to 4.2.23
CVE-2017-12199Aug 1, 2017
Medium6.1
Cross-Site Scripting
Ultimate Product Catalog
≤4.2.11Update to 4.2.12
CVE-2017-12200Aug 1, 2017
Medium6.1
Cross-Site Scripting
Easy Testimonials
≤3.0.4No patch available
CVE-2017-12131Jul 31, 2017