Database

WordPress vulnerabilities listed in CISA KEV (page 1351)

Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress vulnerabilities listed in CISA KEV (page 1351)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting wp-football≤1.1No patch available	CVE-2014-4586	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Appointments Scheduler≤1.5No patch available	CVE-2014-4579	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting Ruven Toolkit≤2.0No patch available	CVE-2014-4548	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting WordPress Responsive Preview<1.2Update to 1.2	CVE-2014-4594	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting VideoWhisper Video Presentation≤3.25Update to 3.31	CVE-2014-4570	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Webcam/Screen/Mic Recorder for Video Comments and Forms≤1.55Update to 1.55.3	CVE-2014-4567	—	Jun 12, 2014
High7.1	Cross-Site Scripting wp-tmkm-amazon<1.5.3Update to 1.5.3	CVE-2014-4598	—	Jun 12, 2014
High7.1	Cross-Site Scripting WP Microblogs≤0.4.0No patch available	CVE-2014-4590	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting WP BlipBot≤3.0.9No patch available	CVE-2014-4580	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Member Approval≤131109No patch available	CVE-2014-3850	—	Jun 10, 2014
Medium4.3	Cross-Site Request Forgery leading to player deletion JW Player for Flash & HTML5 Video<2.1.4Update to 2.1.4	CVE-2014-4030	—	Jun 10, 2014
High8.8	Cross-Site Request Forgery Featured Comments<1.2.5Update to 1.2.5	CVE-2014-4163	—	Jun 10, 2014
Medium6.1	Reflected Cross-Site Scripting Disqus Comment System<2.76Update to 2.76	CVE-2014-5345	—	Jun 9, 2014
Critical9.8	SQL Injection Participants Database<1.5.4.9Update to 1.5.4.9	CVE-2014-3961	—	Jun 2, 2014
High7.2	Cross-Site Scripting simple-popup-images≤1.0Update to 1.1	CVE-2014-3921	—	May 30, 2014
High7.5	Path Traversal Cross-RSS≤1.7No patch available	CVE-2014-4941	—	May 29, 2014
Medium6.1	Unauthenticated Cross-Site Scripting Easy Career Openings≤0.4No patch available	CVE-2014-4523	—	May 28, 2014
Medium6.1	Cross-Site Scripting Bugs Go Viral : Facebook Promotion Generator≤1.3.4No patch available	CVE-2014-4528	—	May 28, 2014
Medium5.3	Sensitive Information Disclosure WP EasyCart: Shopping Cart and eCommerce Store≤2.0.5Update to 2.0.6	CVE-2014-4942	—	May 28, 2014
Medium6.1	Cross-Site Scripting OMFG Mobile Pro≤1.1.26No patch available	CVE-2014-4541	—	May 28, 2014
Medium6.1	Cross-Site Scripting Jigoshop Swipe plugin≤3.1.0No patch available	CVE-2014-4557	—	May 28, 2014
Medium6.1	Cross-Site Scripting ZdStatistics≤2.0.1No patch available	CVE-2014-4605	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting ActiveHelper LiveHelp Live Chat<3.1.5Update to 3.1.5	CVE-2014-4513	—	May 28, 2014
Medium6.1	Cross-Site Scripting Podcast Channels<0.21Update to 0.21	CVE-2014-4544	—	May 28, 2014
High7.1	Cross-Site Scripting Oleggo LiveStream≤0.2.6No patch available	CVE-2014-4540	—	May 28, 2014
Medium6.1	Cross-Site Scripting wppm≤1.6.4.bNo patch available	CVE-2014-4593	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting swipehq-payment-gateway-woocommerce≤2.7.1No patch available	CVE-2014-4558	—	May 28, 2014
High7.1	Cross-Site Scripting Malware Finder≤1.1No patch available	CVE-2014-4538	—	May 28, 2014
Medium6.1	Cross-Site Scripting Validated≤1.0.2Update to 2.0.0	CVE-2014-4564	—	May 28, 2014
High8.8	Authenticated SQL Injection YAWPP (Yet Another WordPress Petition Plugin)≤1.2.1Update to 1.2.2	CVE-2014-5182	—	May 28, 2014

Medium6.1
Cross-Site Scripting
wp-football
≤1.1No patch available
CVE-2014-4586Jun 12, 2014
Medium6.1
Cross-Site Scripting
Appointments Scheduler
≤1.5No patch available
CVE-2014-4579Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
CVE-2014-4548Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
WordPress Responsive Preview
<1.2Update to 1.2
CVE-2014-4594Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
VideoWhisper Video Presentation
≤3.25Update to 3.31
CVE-2014-4570Jun 12, 2014
Medium6.1
Cross-Site Scripting
Webcam/Screen/Mic Recorder for Video Comments and Forms
≤1.55Update to 1.55.3
CVE-2014-4567Jun 12, 2014
High7.1
Cross-Site Scripting
wp-tmkm-amazon
<1.5.3Update to 1.5.3
CVE-2014-4598Jun 12, 2014
High7.1
Cross-Site Scripting
WP Microblogs
≤0.4.0No patch available
CVE-2014-4590Jun 12, 2014
Medium6.1
Cross-Site Scripting
WP BlipBot
≤3.0.9No patch available
CVE-2014-4580Jun 12, 2014
Medium6.1
Cross-Site Scripting
Member Approval
≤131109No patch available
CVE-2014-3850Jun 10, 2014
Medium4.3
Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
CVE-2014-4030Jun 10, 2014
High8.8
Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
CVE-2014-4163Jun 10, 2014
Medium6.1
Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
CVE-2014-5345Jun 9, 2014
Critical9.8
SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
CVE-2014-3961Jun 2, 2014
High7.2
Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
CVE-2014-3921May 30, 2014
High7.5
Path Traversal
Cross-RSS
≤1.7No patch available
CVE-2014-4941May 29, 2014
Medium6.1
Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
CVE-2014-4523May 28, 2014
Medium6.1
Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
CVE-2014-4528May 28, 2014
Medium5.3
Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
CVE-2014-4942May 28, 2014
Medium6.1
Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
CVE-2014-4541May 28, 2014
Medium6.1
Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
CVE-2014-4557May 28, 2014
Medium6.1
Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
CVE-2014-4605May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
CVE-2014-4513May 28, 2014
Medium6.1
Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
CVE-2014-4544May 28, 2014
High7.1
Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
CVE-2014-4540May 28, 2014
Medium6.1
Cross-Site Scripting
wppm
≤1.6.4.bNo patch available
CVE-2014-4593May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available
CVE-2014-4558May 28, 2014
High7.1
Cross-Site Scripting
Malware Finder
≤1.1No patch available
CVE-2014-4538May 28, 2014
Medium6.1
Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
CVE-2014-4564May 28, 2014
High8.8
Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
CVE-2014-5182May 28, 2014