CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 1288)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2019-16118 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16117 | — | |
| Critical9.8 | SQL Injection | CVE-2019-16119 | — | |
| High7.5 | Arbitrary Settings Change | CVE-2019-15895 | — | |
| Medium5.4 | Reflected Cross-Site Scripting via Shortcode Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16219 | — | |
| High7.2 | Stored Cross-Site Scripting via Comments WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16218 | — | |
| Medium5.4 | Authenticated Cross-Site Scripting via Post Previews WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16223 | — | |
| Medium6.4 | Stored Cross-Site Scripting via Comments via URLs WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16222 | — | |
| Medium6.4 | Cross-Site Scripting via Media Uploads WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16217 | — | |
| Medium6.1 | Reflected Cross-Site Scripting WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16221 | — | |
| Medium4.6 | Open Redirect WordPress≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3 | CVE-2019-16220 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-16332 | — | |
| High8.8 | CSV Injection | CVE-2019-16120 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-1010124 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2019-15777 | — | |
| High7.5 | Unauthenticated Settings Change | CVE-2019-15816 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14314 | 300K+ | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15769 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9352 | — | |
| Medium5.3 | Improper Input Validation | CVE-2019-14978 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-14470 | — | |
| High7.5 | Missing Authorization to Settings Update | CVE-2019-15821 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15770 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2019-15778 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-18564 | — | |
| High7.5 | Missing Authorization Checks | CVE-2015-9331 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2019-14774 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-15817 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10895 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10887 | — |
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.34Update to 1.5.35
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.35Update to 1.5.35
- Critical9.8SQL Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.35Update to 1.5.35
- High7.5Arbitrary Settings Change
Search Exclude
<1.2.4Update to 1.2.4
- Medium5.4Reflected Cross-Site Scripting via Shortcode Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- High7.2Stored Cross-Site Scripting via Comments
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.13 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium5.4Authenticated Cross-Site Scripting via Post Previews
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.4Stored Cross-Site Scripting via Comments via URLs
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.4Cross-Site Scripting via Media Uploads
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.1Reflected Cross-Site Scripting
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium4.6Open Redirect
WordPress
≤5.2.2Update to 3.7.30 or 3.8.30 or 3.9.28 or 4.0.27 or 4.1.27 or 4.2.24 or 4.3.20 or 4.4.19 or 4.5.18 or 4.6.15 or 4.7.14 or 4.8.10 or 4.9.11 or 5.0.6 or 5.1.2 or 5.2.3
- Medium6.1Cross-Site Scripting
API Bearer Auth
<20190907Update to 20190907
- High8.8CSV Injection
Event Tickets and Registration
≤4.10.7.1Update to 4.10.7.2
- Medium6.1Reflected Cross-Site Scripting
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
≤3.1.14Update to 3.1.15
- Medium5.4Cross-Site Scripting
WP DSGVO Tools (GDPR)
<2.2.19Update to 2.2.19
- High7.5Unauthenticated Settings Change
WP Private Content Plus
≤1.31Update to 2.0
- Critical9.8SQL Injection
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<3.2.11Update to 3.2.11
- High8.8Cross-Site Request Forgery
HandL UTM Grabber / Tracker
<2.6.5Update to 2.6.5
- Critical9.8SQL Injection
WP-Polls
≤2.71Update to 2.72
- Medium5.3Improper Input Validation
WooCommerce PayU India (PayUmoney – PayUbiz)
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
UserPro - Community and User Profile WordPress Plugin
≤4.9.34Update to 4.9.35.1
- High7.5Missing Authorization to Settings Update
Bold Page Builder
≤2.3.1Update to 2.3.2
- High8.8Cross-Site Request Forgery
Address Book for WooCommerce
<1.6.0Update to 1.6.0
- Medium6.4Authenticated Stored Cross-Site Scripting
Additional Variation Images Gallery for WooCommerce
<1.1.29Update to 1.2.29
- Medium6.1Reflected Cross-Site Scripting
Sender by BestWebSoft
≤1.2.0Update to 1.2.1
- High7.5Missing Authorization Checks
WP All Import Pro
<4.1.1Update to 4.1.1
- Medium6.1Reflected Cross-Site Scripting
Variation Swatches for WooCommerce
<1.0.62Update to 1.0.62
- Medium6.1Cross-Site Scripting
Easy Property Listings
≤3.3.3Update to 3.4
- Medium6.1Cross-Site Scripting
OptionTree
≤2.5.5Update to 2.6
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.9Update to 4.0.9