Database
WordPress Vulnerability Database (page 1376)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SQL Injection | CVE-2017-1002005 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002003 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002001 | — | |
| Medium6.1 | HTML Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<3.0.31Update to 3.0.31 | CVE-2017-18574 | — | |
| Medium4.9 | Arbitrary File Deletion WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6816 | — | |
| Medium6.4 | Cross-Site Scripting via Taxonomy names WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6818 | — | |
| Medium6.1 | Bypass URL Validation WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6815 | — | |
| Medium6.4 | Cross-Site Scripting via Media Metadata WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6814 | — | |
| Medium6.4 | Authenticated Cross-Site Scripting in Youtube URL Embeds WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6817 | — | |
| High8.8 | Cross-Site Request Forgery via Press This WordPress≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3 | CVE-2017-6819 | — | |
| High7.2 | SQL Injection via filter_list | CVE-2017-6574 | — | |
| High7.2 | SQL Injection via id parameter | CVE-2017-6576 | — | |
| Critical9.8 | Security Bypass to Database Login | CVE-2017-20066 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2017-6102 | — | |
| Medium6.1 | Cross-Site Scripting via Cross-Site Request Forgery | CVE-2024-27948 | — | |
| High8.8 | Cross-Site Request Forgery | — | — | |
| High8.1 | Remote Code Execution | — | — | |
| High8.8 | Cross-Site Request Forgery | — | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2017-20055 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2017-18572 | — | |
| High8.8 | Cross-Site Request Forgery to Arbitrary File Upload | — | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-20090 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-20054 | — | |
| Medium5.3 | Missing Authorization | CVE-2017-1002000 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2017-18575 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2017-20053 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2017-1002002 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Stored Cross-Site Scripting | — | — | |
| Medium6.1 | Cross-Site Scripting via method | — | — |
- Critical9.8SQL Injection
DTracker
≤1.5No patch available
- Critical9.8Arbitrary File Upload
Wp2android
≤1.1.4No patch available
- Critical9.8Arbitrary File Upload
Mobile App Builder by WapPress
≤1.05No patch available
- Medium6.1HTML Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.0.31Update to 3.0.31
- Medium4.9Arbitrary File Deletion
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Cross-Site Scripting via Taxonomy names
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.1Bypass URL Validation
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Cross-Site Scripting via Media Metadata
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- Medium6.4Authenticated Cross-Site Scripting in Youtube URL Embeds
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- High8.8Cross-Site Request Forgery via Press This
WordPress
≤4.7.2Update to 3.7.19 or 3.8.19 or 3.9.17 or 4.0.16 or 4.1.16 or 4.2.13 or 4.3.9 or 4.4.8 or 4.5.7 or 4.6.4 or 4.7.3
- High7.2SQL Injection via filter_list
Mail Masta
≤1.0No patch available
- High7.2SQL Injection via id parameter
Mail Masta
≤1.0No patch available
- Critical9.8Security Bypass to Database Login
adminer
≤1.4.5No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
wordpress plugin rockhoist-badges
≤1.2.2No patch available
- Medium6.1Cross-Site Scripting via Cross-Site Request Forgery
Atahualpa
≤3.7.24No patch available
- High8.8Cross-Site Request Forgery
Download Manager
≤2.9.45Update to 2.9.46
- High8.1Remote Code Execution
Jetpack VaultPress
≤1.8.6Update to 1.8.7
- High8.8Cross-Site Request Forgery
Gwolle Guestbook
≤2.1.0Update to 2.1.1
- Medium6.4Stored Cross-Site Scripting
Contact Form Plugin
≤4.0.1Update to 4.0.2
- High7.2Stored Cross-Site Scripting
GNUCommerce
<1.4.2Update to 1.4.2
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
File Manager
<4.1.5Update to 4.1.5
- High8.8Cross-Site Request Forgery
Global Content Blocks
≤2.1.5No patch available
- Medium6.1Cross-Site Scripting
Contact Form Manager
≤1.4.3Update to 1.4.4
- Medium5.3Missing Authorization
How to Create an App for Android iPhone Easytouch
≤3.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
NewStatPress
<1.2.5Update to 1.2.5
- High8.8Cross-Site Request Forgery
Contact Form Manager
≤1.4.3Update to 1.4.4
- Critical9.8Arbitrary File Upload
webapp-builder
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
WP-Filebase
≤3.4.23Update to 3.4.24
- Medium6.1Stored Cross-Site Scripting
Gwolle Guestbook
≤2.1.0Update to 2.1.1
- Medium6.1Cross-Site Scripting via method
Slideshow Gallery LITE
≤1.6.5Update to 1.6.6