CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 1301)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.2 | Authenticated SQL Injection Kadence Security – Password, Two Factor Authentication, and Brute Force Protection<7.0.3Update to 7.0.3 | CVE-2018-12636 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-21002 | — | |
| Medium6.1 | CSV Injection | CVE-2018-11526 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-1000505 | — | |
| High7.8 | CSV Injection | CVE-2018-11525 | — | |
| High8.8 | SQL Injection | CVE-2019-1010104 | — | |
| Critical9.8 | SQL Injection | CVE-2018-10969 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-1000512 | — | |
| High7.3 | Missing Authorization | CVE-2018-11580 | — | |
| High7.5 | Unauthenticated Parameter Manipulation | CVE-2018-10363 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-11633 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2018-11709 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2018-11632 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11486 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-11485 | — | |
| Medium6.5 | Missing Authorization | CVE-2018-11579 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-20982 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-0603 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-20974 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-0602 | — | |
| Critical9.8 | Blind SQL Injection | CVE-2018-11309 | — | |
| Critical9.8 | SQL Injection | CVE-2018-11515 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2018-11366 | — | |
| High8.8 | Remote Code Execution | CVE-2019-15873 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2018-21012 | — | |
| Medium5.3 | Unauthorized Access to Information Disclosure | CVE-2018-21011 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2018-1000506 | — | |
| High7.5 | Missing Authorization | CVE-2018-1000511 | — | |
| High7.2 | Cross-Site Scripting | CVE-2018-1000508 | — | |
| Medium4.3 | Improper Access Control | CVE-2018-0589 | — |
- High7.2Authenticated SQL Injection
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
<7.0.3Update to 7.0.3
- High8.8Cross-Site Request Forgery
JS Help Desk – AI-Powered Support & Ticketing System
≤2.0.5Update to 2.0.6
- Medium6.1CSV Injection
Comments Import & Export
≤2.0.4Update to 2.0.5
- Medium6.5Cross-Site Request Forgery
Tooltipy (tooltips for WP)
<5.1Update to 5.1
- High7.8CSV Injection
Advanced Order Export For WooCommerce
≤1.5.4Update to 1.5.5
- High8.8SQL Injection
Quick Chat
≤4.14No patch available
- Critical9.8SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
≤3.0.9Update to 3.0.10
- Medium6.1Reflected Cross-Site Scripting
Tooltipy (tooltips for WP)
<5.1Update to 5.1
- High7.3Missing Authorization
Mass Pages/Posts Creator
≤1.2.2Update to 1.2.3
- High7.5Unauthenticated Parameter Manipulation
Booking calendar, Appointment Booking System
≤2.2.2Update to 2.2.3
- Medium6.5Cross-Site Request Forgery
Digital Goods for WooCommerce Checkout
<2.2Update to 2.2
- Medium6.1Reflected Cross-Site Scripting
wpForo Forum
<1.4.12Update to 1.4.12
- Medium6.5Cross-Site Request Forgery
Add Social Share Buttons for Whatsapp and Viber
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
Advance Search for WooCommerce
<1.1Update to 1.1
- Medium6.1Cross-Site Scripting
Advance Search for WooCommerce
<1.1Update to 1.1
- Medium6.5Missing Authorization
Banner Management For WooCommerce
≤1.1.0Update to 1.1.1
- Medium6.1Cross-Site Scripting
Media Library Assistant
<2.7.4Update to 2.74
- Medium6.1Cross-Site Scripting
Site Reviews
<2.15.3Update to 2.15.3
- High8.8Cross-Site Request Forgery
JS Job Manager
≤1.0.6Update to 1.0.7
- Medium6.1Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤3.4.12Update to 3.5.0
- Critical9.8Blind SQL Injection
membermouse
≤2.2.8Update to 2.2.9
- Critical9.8SQL Injection
wpForo Forum
≤1.4.12Update to 1.4.13
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Loginizer
1.3.8 – 1.3.9Update to 1.4.0
- High8.8Remote Code Execution
ProfileGrid – User Profiles, Groups and Communities
<2.8.6Update to 2.8.6
- Medium6.1Cross-Site Scripting
CF7 Invisible reCAPTCHA
<1.3.2Update to 1.3.2
- Medium5.3Unauthorized Access to Information Disclosure
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
<1.5.14Update to 1.5.14
- High8.8Cross-Site Request Forgery
Metronet Tag Manager
<1.2.9Update to 1.2.9
- High7.5Missing Authorization
WP ULike – Like Buttons, Voting & Engagement Analytics
<3.2Update to 3.2
- High7.2Cross-Site Scripting
WP ULike – Like Buttons, Voting & Engagement Analytics
<3.2Update to 3.2
- Medium4.3Improper Access Control
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.3Update to 2.0.4