Database
WordPress vulnerabilities listed in CISA KEV (page 1348)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Reflected Cross-Site Scripting | CVE-2014-4565 | — | |
| Medium4.7 | Cross-Site Request Forgery | CVE-2013-2705 | — | |
| High7.3 | Unspecified Vulnerability | CVE-2012-4327 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2013-2704 | — | |
| Medium6.1 | DOM Cross-Site Scripting | CVE-2013-6837 | — | |
| High8.8 | SQL Injection | CVE-2012-5327 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-2008 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-3476 | — | |
| High7.5 | Local File Inclusion | CVE-2014-4577 | — | |
| Critical9.8 | Unrestricted File Upload | CVE-2014-4972 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-4954 | — | |
| High7.1 | Cross-Site Scripting | CVE-2013-2695 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3261 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-5918 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-3923 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2007-2484 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-0895 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4602 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-10378 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-5072 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7479 | — | |
| Medium6.1 | Unauthenticated Multiple Cross-Site Scripting | CVE-2012-6630 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2013-10026 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-2287 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100007 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4856 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3256 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2011-5128 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-2550 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-4725 | — |
- Medium5.3Reflected Cross-Site Scripting
Verification Code for Comments
≤2.1.0No patch available
- Medium4.7Cross-Site Request Forgery
Simple Shopping Cart
<3.6Update to 3.6
- High7.3Unspecified Vulnerability
Image News Slider
≤3.2Update to 3.3
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- Medium6.1DOM Cross-Site Scripting
Image Slider
<1.1.7Update to 1.1.7
- High8.8SQL Injection
Mingle Forum
≤1.0.32.1Update to 1.0.33
- Medium6.1Multiple Cross-Site Scripting
WP Super Cache
≤1.3Update to 1.3.1
- Medium4.3Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
- High7.5Local File Inclusion
WP AmASIN – The Amazon Affiliate Shop
≤0.9.6Update to 0.9.7
- Critical9.8Unrestricted File Upload
gravity-file-ajax-upload-free
≤1.1No patch available
- Medium6.1Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
- High7.1Cross-Site Scripting
WP Symposium
<13.04Update to 13.04
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
- Medium6.1Reflected Cross-Site Scripting
Platinum SEO
≤1.3.7Update to 1.3.8
- Medium6.1Reflected Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
- Critical9.8Remote File Inclusion
WP-Table
≤1.43Update to 1.44
- Medium6.1Cross-Site Scripting
Count per Day
≤3.1Update to 3.1.1
- Medium6.1Cross-Site Scripting
XEN Carousel
≤0.12.2No patch available
- Medium6.1Cross-Site Scripting
Yoast Duplicate Post
≤2.6Update to 3.0
- High8.8Cross-Site Request Forgery
WP Activity Log
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.3.9Update to 5.3.9
- Medium6.1Unauthenticated Multiple Cross-Site Scripting
Media Library Categories
≤1.1.1No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Mail Subscribe List
≤2.0.9Update to 2.1
- Medium6.1Multiple Cross-Site Scripting
Uploader
≤1.0.4No patch available
- Medium6.1Cross-Site Scripting
HK Exif Tags
≤1.11Update to 1.12
- Medium6.1Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.24Update to 2.0.25
- High8.8Cross-Site Request Forgery
sexybookmarks
≤6.1.4.0Update to 6.1.5.0
- Medium5.3Cross-Site Scripting
Adminimize
<1.7.22Update to 1.7.22
- High8.8Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
- Critical9.8Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7