Database
WordPress Vulnerability Database (page 1378)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.2 | PHP Object Injection | — | — | |
| High8.1 | Authenticated Directory Traversal leading to Local File Inclusion | CVE-2017-18585 | — | |
| High7.5 | Directory Traversal | CVE-2017-20287 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18541 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-9288 | — | |
| Critical9.8 | SQL Injection | CVE-2017-18548 | — | |
| Medium5.3 | Cross-Site Scripting | — | — | |
| Medium6.1 | Open Redirect | — | — | |
| High7.3 | Arbitrary Page Modification WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-1001000 | — | |
| High8.8 | Authenticated SQL Injection WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-5611 | — | |
| Medium6.1 | Cross-Site Scripting WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-5612 | — | |
| Medium4.3 | Authorization Bypass to Term Disclosure WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-5610 | — | |
| Critical9.8 | Unauthenticated PHP Object Injection | CVE-2016-15004 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2017-20177 | — | |
| High8.8 | SQL Injection | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18526 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18576 | — | |
| Critical9.8 | Local File Inclusion | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-18536 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18612 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10892 | — | |
| High8.3 | Authorization Bypass WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5491 | — | |
| High8.8 | Cross-Site Request Forgery via Uploading Flash File WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5489 | — | |
| Medium5.5 | Stored Cross-Site Scripting via theme directory name WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5490 | — | |
| Medium5.5 | Cross-Site Scripting via Name and Version Header of Plugin WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5488 | — | |
| High8.8 | Cross-Site Request Forgery via Widget Editing WordPress≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5492 | — | |
| Medium4.3 | Information Disclosure WordPress≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5487 | — | |
| Medium5.3 | Weak Multi-Site Activation Key for User and Site Signup WordPress≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1 | CVE-2017-5493 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | — | — |
- High7.2PHP Object Injection
Row Seats Core
<2.68Update to 2.68
- High8.1Authenticated Directory Traversal leading to Local File Inclusion
Posts in Page
<1.3.0Update to 1.3.0
- High7.5Directory Traversal
Javo Spot - Multi Purpose Directory WordPress Theme
<3.0.0Update to 3.0.0
- Medium6.1Cross-Site Scripting
XO Security
<1.5.3Update to 1.5.3
- Medium6.1Reflected Cross-Site Scripting
Raygun
≤1.8.0Update to 1.8.1
- Critical9.8SQL Injection
Note Press
<0.1.2Update to 0.1.2
- Medium5.3Cross-Site Scripting
WP Super Cache
≤1.4.8Update to 1.4.9
- Medium6.1Open Redirect
Translate WordPress with GTranslate
<2.8.11Update to 2.8.11
- High7.3Arbitrary Page Modification
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- High8.8Authenticated SQL Injection
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Medium6.1Cross-Site Scripting
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Medium4.3Authorization Bypass to Term Disclosure
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Critical9.8Unauthenticated PHP Object Injection
InfiniteWP Client
<1.6.1.1Update to 1.6.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
WangGuard
<1.8.0Update to 1.8.0
- High8.8SQL Injection
WP Email Users
≤1.4.4Update to 1.4.5
- Medium6.1Reflected Cross-Site Scripting
WangGuard
≤1.7.2Update to 1.7.3
- Medium6.1Cross-Site Scripting
moreAds SE
≤1.4.6Update to 1.4.7
- Medium6.1Cross-Site Scripting
Event Notifier
≤1.2.0Update to 1.2.1
- Critical9.8Local File Inclusion
Direct Download for Woocommerce
<1.16Update to 1.16
- Medium6.1Cross-Site Scripting
Stop User Enumeration
<1.3.8Update to 1.3.8
- Medium6.1Reflected Cross-Site Scripting
WP Whois Domain
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
Chained Quiz
<1.0Update to 1.0
- High8.3Authorization Bypass
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- High8.8Cross-Site Request Forgery via Uploading Flash File
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium5.5Stored Cross-Site Scripting via theme directory name
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium5.5Cross-Site Scripting via Name and Version Header of Plugin
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- High8.8Cross-Site Request Forgery via Widget Editing
WordPress
≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium4.3Information Disclosure
WordPress
≤4.7Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- Medium5.3Weak Multi-Site Activation Key for User and Site Signup
WordPress
≤4.7.0Update to 3.7.17 or 3.8.17 or 3.9.15 or 4.0.14 or 4.1.14 or 4.2.11 or 4.3.7 or 4.4.6 or 4.5.5 or 4.6.2 or 4.7.1
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Responsive Poll
<1.7.6Update to 1.7.6