Database
WordPress Vulnerability Database (page 1371)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.4 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18512 | — | |
| High7.1 | Reflected Cross-Site Scripting | — | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002023 | — | |
| Critical9.8 | Authenticated SQL Injection | CVE-2017-1002020 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2017-1002022 | — | |
| Critical9.8 | SQL Injection | CVE-2017-1002021 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18522 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18523 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2168 | — | |
| Medium5.4 | Authorization Bypass Allowing Post Meta Updates WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9065 | — | |
| High8.8 | Cross-Site Request Forgery Filesystem Credential Update WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9064 | — | |
| Medium6.3 | Mishandling Post Meta Values via XML-RPC WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9062 | — | |
| Medium5.3 | User Enumeration | CVE-2017-1000226 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2187 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2169 | — | |
| High7.7 | Server-Side Request Forgery WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9066 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9063 | — | |
| Medium6.4 | Stored Cross-Site Scripting via filenames WordPress≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5 | CVE-2017-9061 | — | |
| Medium5.4 | Cross-Site Scripting | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18578 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-18547 | — | |
| High7.5 | Denial of Service | — | — | |
| Medium6.1 | Cross-Site Scripting | — | — | |
| High7.5 | Directory Traversal | CVE-2017-1000170 | — | |
| High7.1 | Cross-Site Request Forgery to Stored Cross-Site Scripting | — | — | |
| Medium6.5 | Missing Authorization | — | — | |
| Medium5.9 | Unauthorized Password Reset via Interception | CVE-2017-8295 | — | |
| High8.8 | SQL Injection | — | — |
- Medium5.4Reflected Cross-Site Scripting
Newsletters
≤4.6.5.2Update to 4.6.5.3
- Medium6.1Reflected Cross-Site Scripting
Simple Slideshow Manager
≤2.3Update to 2.3.1
- High8.8Cross-Site Request Forgery
Newsletter by Supsystic
<1.1.8Update to 1.1.8
- High7.1Reflected Cross-Site Scripting
AffiliateWP
<2.0.9.1Update to 2.0.9.1
- Critical9.8SQL Injection
Easy Team Manager
≤1.3.2No patch available
- Critical9.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- High8.8Authenticated SQL Injection
surveys
≤1.01.8No patch available
- Critical9.8SQL Injection
surveys
≤1.01.8No patch available
- Medium6.1Cross-Site Scripting
EELV Newsletter
<4.6.1Update to 4.6.1
- High8.8Cross-Site Request Forgery
EELV Newsletter
≤4.6.0Update to 4.6.1
- Medium6.1Cross-Site Scripting
WP Booking System – Booking Calendar
<1.4Update to 1.4
- Medium5.4Authorization Bypass Allowing Post Meta Updates
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- High8.8Cross-Site Request Forgery Filesystem Credential Update
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.3Mishandling Post Meta Values via XML-RPC
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium5.3User Enumeration
Stop User Enumeration
<1.3.9Update to 1.3.9
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤7.0.06Update to 7.0.07
- Medium6.1Cross-Site Scripting
MaxButtons – Create buttons
≤6.18Update to 6.19
- High7.7Server-Side Request Forgery
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium6.4Stored Cross-Site Scripting via filenames
WordPress
≤4.7.4Update to 3.7.21 or 3.8.21 or 3.9.19 or 4.0.18 or 4.1.18 or 4.2.15 or 4.3.11 or 4.4.10 or 4.5.9 or 4.6.6 or 4.7.5
- Medium5.4Cross-Site Scripting
Ultimate Addons for WPBakery
≤3.16.11Update to 3.16.12
- Medium6.1Cross-Site Scripting
Crafty Social Buttons
<1.5.8Update to 1.5.8
- High8.8Cross-Site Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
<4.6.4Update to 4.6.4
- High7.5Denial of Service
Tracking Code Manager
≤1.11.4Update to 1.11.5
- Medium6.1Cross-Site Scripting
Tracking Code Manager
≤1.11.4Update to 1.11.5
- High7.5Directory Traversal
Task Scheduler
≤1.6.0Update to 1.6.1
- High7.1Cross-Site Request Forgery to Stored Cross-Site Scripting
MSMC – Redirect After Comment
≤2.1.2No patch available
- Medium6.5Missing Authorization
Download Monitor
≤1.9.6Update to 1.9.7
- Medium5.9Unauthorized Password Reset via Interception
WordPress
<5.5Update to 5.5
- High8.8SQL Injection
WDSocialWidgets
≤1.0.13Update to 1.0.14